Five Microsoft 365 settings for a small office
MFA, admin accounts, forwarding rules, sharing links, and a backup. Five settings that close the doors people actually leave open.
Microsoft 365 can be a tidy office or a junk drawer with a login. These five settings are the difference, and none of them require a new product.
1. Multi-factor authentication for everyone. Including the owner. Especially the owner. An account that can reset everyone else is the one worth stealing.
2. Two admin accounts, used only for admin work. Daily mail happens in a normal mailbox. Admin work happens in a separate account that does not browse the web for fun. If one admin is on vacation, the other can still get in. Write the names down.
3. Look for mailbox rules you did not create. A criminal who gets into mail will often add a rule that forwards copies, or that deletes messages with words like “invoice” or “wire.” Check the rules. If you do not know how, that is a fair thing to hand to an IT team.
4. Sharing links that match the audience. “Anyone with the link” is convenient and it is also how a proposal ends up in the wrong hands. Default to people in the company, and make a public link a deliberate choice. Do this before you turn on an AI assistant. Those tools can surface whatever the user is already allowed to open.
5. A backup that is not Microsoft’s recycle bin. Microsoft keeps the service running. You still want a copy you can restore if a mailbox is deleted or a library is encrypted. Test it once. Write down the date.
If the tenant was set up in a hurry during a move, assume these five are messy until someone looks. That look is part of a Microsoft 365 engagement and part of the free assessment. You can also start with the checklist, which covers the same ground without a login.