Microsoft 365 hardening: the 12 settings every SME tenant should change today

Microsoft Secure Score on a freshly provisioned Microsoft 365 Business Premium tenant typically lands between 35% and 50%. Microsoft’s defaults favour deployment speed over security: legacy authentication is enabled, MFA is not enforced for non-admins, attachments are scanned with default heuristics only, and audit logs are retained for 90 days. None of this passes a NIS2 or ISO 27001 audit. The good news: 12 settings move you from "default" to "audit-defensible" in one afternoon.

Apply in this order. Each takes 5–15 minutes; total work is 2–3 hours for an experienced admin. All settings are in the M365 Admin Center, Entra ID portal, or Defender portal.

• 1. Disable legacy authentication (Entra ID → Conditional Access → block "Other clients"). Closes 99% of password-spray attacks instantly.
• 2. Enforce MFA on every user via Conditional Access (not Security Defaults — you need granular policies). Phishing-resistant MFA (FIDO2/WebAuthn or Authenticator number-match) for all admins.
• 3. Block sign-in from countries you don’t do business in (Conditional Access → named locations → block).
• 4. Disable self-service consent to apps (Entra ID → Enterprise Apps → Consent and permissions → "Do not allow user consent"). Stops OAuth phishing dead.
• 5. Enable Continuous Access Evaluation (Entra ID → Security → CAE) — revokes tokens within minutes when risk changes.
• 6. Configure Defender for Office 365 Safe Links and Safe Attachments (Strict preset). Default Standard preset is too lenient.
• 7. Enable anti-phishing impersonation protection (Defender → Policies → Anti-phishing → add your CEO/CFO/MD as protected users).
• 8. Increase mailbox audit log retention to 1 year minimum (default is 90 days; 365+ days is needed for any NIS2/GDPR forensic timeline).
• 9. Enable Unified Audit Log search (off by default in some tenants — Compliance portal → Audit → Start recording user and admin activity).
• 10. Block external email forwarding rules (Defender → Anti-spam outbound policy → forwarding to external addresses: Off). Stops the most common BEC persistence trick.
• 11. Restrict guest access in Teams and SharePoint (External Sharing → "New and existing guests only"). Default "Anyone" is a data-leak vector.
• 12. Enable mailbox audit logging for all mailboxes via PowerShell (Set-Mailbox -Identity * -AuditEnabled $true) — Microsoft enables this by default but tenant migrations frequently disable it silently.

In our audits of 40+ SME M365 tenants, the 12-step checklist moves Secure Score from a median of 42% to 78%, blocks the three most common attack patterns we see in real incidents, and produces enough audit evidence for ISO 27001 control A.5.15 (Access Control) and A.8.5 (Secure Authentication) without any further work.

These need a bit more planning — pilot user group first.

• Microsoft Defender for Endpoint integration (or Bitdefender GravityZone if you run Bitdefender) — full EDR on every M365 device
• Privileged Identity Management (PIM): just-in-time elevation for Global Admin and Exchange Admin
• Information Protection sensitivity labels: classify and auto-encrypt confidential documents
• Conditional Access Risk-Based policies: block sign-ins flagged "high risk" by Entra ID Protection
• Restrict app passwords and unmanaged device access (only intune-compliant or hybrid-joined devices can sync mail)

Three reasons we hear from SMEs for not doing this — and the regulator’s response in real cases:

• "MFA is too disruptive for our users." → AEPD ruled in 2024 that an SME breached via password-spray without MFA had failed Art. 32 RGPD; €60k fine. User experience is not a defence.
• "We don’t have anyone to manage Conditional Access." → ICO and CNIL both treat this as the controller’s problem, not the user’s. Hire it out.
• "We use the free Office E1 plan." → Then your tenant cannot pass NIS2 Art. 21 baseline. Upgrade to Business Premium (€21/user/month) or commit to a third-party email security stack.

We apply the 12-setting checklist + the quarter-2 stack to your tenant in a 4-hour engagement, document the before/after Secure Score with screenshots, and hand you the audit-evidence pack. Fixed price, no surprises. Book a discovery call and we will quote within one business day.