A freshly provisioned Microsoft 365 tenant is not a secure Microsoft 365 tenant. Microsoft ships its platform with default settings optimized for broad compatibility across millions of different business configurations — not for security. Most of the controls that meaningfully reduce your attack surface require active configuration. The good news: the tools are already included in your license. For most Florida small businesses, closing the most critical security gaps in Microsoft 365 is a matter of hours of configuration, not additional software spend. Here are the 8 settings that matter most.
99.9%
Of compromised accounts had no MFA
35%
Average M365 Secure Score across all tenants
94%
Phishing attacks using legacy auth protocols
$0
Additional cost to implement all 8 hardening steps
Security Defaults vs. Conditional Access — Which Does Your Business Need?
Microsoft offers two ways to enforce baseline security policies. Security Defaults is a free, single-toggle option that enables MFA for all users, requires MFA for admin roles, blocks legacy authentication protocols, and protects privileged actions. It takes 15 minutes to enable and is the right choice for organizations that need a quick baseline improvement and are on any Microsoft 365 business or enterprise plan.
Conditional Access requires Microsoft 365 Business Premium (or Azure AD P1) and provides granular policy control — require MFA only from outside the office, block access from non-compliant devices, grant different access levels based on real-time user risk, and enforce session timeouts per application. For Florida businesses with compliance requirements (HIPAA, FTC Safeguards, Florida Bar) or sensitive data, Conditional Access policies are the appropriate standard. Security Defaults and Conditional Access cannot be used simultaneously — you choose one.
The 8 Highest-Impact M365 Security Settings for Florida Small Businesses
01
Enable Security Defaults or Conditional Access — pick one
The single most impactful action. Security Defaults blocks 99.9% of account compromise attacks immediately. If you are on Business Premium, deploy Conditional Access policies instead. If neither is enabled on your tenant today, this is your first call to your IT provider.
02
Block legacy authentication protocols
Legacy authentication protocols (IMAP, POP, SMTP AUTH, basic auth) do not support MFA and are the primary attack vector for credential stuffing against Microsoft 365. Even if MFA is enabled, a legacy auth connection can bypass it. Block legacy auth in the Exchange admin center and via Conditional Access or Security Defaults — it may break old email clients (Outlook 2010, some printers and scanners) that need to be updated.
03
Configure SPF, DKIM, and DMARC
Email authentication records prevent attackers from sending email that appears to come from your domain. SPF (Sender Policy Framework) tells receiving servers which IPs are authorized to send your mail. DKIM (DomainKeys Identified Mail) signs outbound email cryptographically. DMARC tells receiving servers what to do with email that fails SPF or DKIM. All three require DNS record changes. Without them, your domain can be spoofed for phishing attacks against your clients and vendors.
04
Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments
Safe Links re-rewrites URLs in email and Teams messages, checking them at click time against Microsoft's threat intelligence. Safe Attachments detonates email attachments in a sandbox before delivery. Both are included with Microsoft 365 Business Premium and significantly reduce phishing and malware delivery success rates. They require activation in the Microsoft 365 Defender portal — they are not on by default.
05
Restrict external sharing in SharePoint and OneDrive
By default, SharePoint and OneDrive allow sharing with anyone, including people outside your organization without accounts. Most businesses should restrict this to existing guests (people in your Azure AD directory) or verified Microsoft accounts at minimum. For healthcare, legal, and financial services, external sharing should be restricted to specific approved domains only. Configure this in the SharePoint admin center under Policies → Sharing.
06
Enable audit logging and set retention
Microsoft 365 audit logging captures user and admin activity across Exchange, SharePoint, Teams, and Azure AD. It is enabled by default in most tenants but the default retention is 90 days for Business plans. Configure audit log retention to at least 1 year. Audit logs are the data source for incident investigation — without them you cannot reconstruct what happened during a security event or answer regulatory questions about who accessed what data.
07
Enroll devices in Intune (Business Premium) or enable Mobile Device Management
Devices that access Microsoft 365 but are not managed carry unknown risk — they may be running out-of-date software, may lack disk encryption, and may not be wiped if stolen. Microsoft 365 Business Premium includes Microsoft Intune, which allows you to enforce minimum security requirements on all devices accessing company data, push configuration policies, and remotely wipe devices. At minimum, enable the built-in Basic Mobility and Security for mobile devices on all M365 plans.
08
Check your Microsoft Secure Score monthly
Microsoft Secure Score in the Defender portal provides a prioritized list of recommended security improvements with step-by-step implementation guidance. Review it monthly. Most recommendations are one-click or one-policy changes. A well-managed Business Premium tenant should score 60-75%. If your IT provider has not shown you your Secure Score, ask them to.
// Key Takeaway
A properly hardened Microsoft 365 tenant eliminates the majority of attack vectors that result in account compromise, data theft, and ransomware delivery. Most of these controls are included in your existing license and require configuration, not additional spend. Simply IT performs a Microsoft 365 security hardening review as part of every managed IT onboarding — and monitors Secure Score monthly to catch configuration drift. If your Secure Score is below 50%, your tenant has significant unaddressed risk.
