Most businesses set up Microsoft 365 once, when they first move their email across, and never open the settings again. That makes sense. Email arrives, files open, Teams works. But Microsoft's starting settings are chosen to make things easy, and easy isn't always safe.

When we take on a new client, these are the first five things we look at. None of them needs new software. Whoever looks after your Microsoft 365 account can check all five in under an hour.

1. Is the second login step on for everyone?

Multi-factor authentication, or MFA, is the code or phone prompt you get after typing your password. With it on, a stolen password isn't enough to get into the account. It should be on for every person in the business, not just the owner or the admin account. Older Microsoft 365 accounts often still have it off, or leave it up to each person to opt in.

2. Who holds the keys to the whole account?

A few accounts have "global admin" rights. They can read anyone's email, reset any password and change any setting. We often find this access held by people who left years ago, by a previous IT company, or by someone's everyday login. Keep that list as short as you can. The people who do need admin rights should use a separate admin login for that work, not the account they read email with.

3. Can staff share files with anyone on the internet?

OneDrive and SharePoint are where Microsoft 365 keeps your files. Out of the box, they often let staff send a link that anyone can open. That's handy for sending a quote to a client. It also means a payroll spreadsheet can leave the business in two clicks without anyone noticing. Most businesses are better off allowing sharing only with named people outside the business.

4. Is a mailbox quietly forwarding email somewhere else?

When criminals get into a mailbox, one of the first things they do is set up a hidden rule that copies every email to an outside address. Then they read your invoices and conversations for weeks, waiting for the right moment to send a fake one. Check for rules sending email outside the business, and block automatic forwarding altogether unless someone has a real reason for it.

5. Will you be able to see what happened?

Microsoft 365 can keep a record of who signed in, from where, and what they did in each mailbox. After a break-in, those records show which emails were read, what was sent and when it started. Recording is usually on now, but older accounts are worth checking. Without it, working out what happened is guesswork.

Minutes now, or days later

Each of these takes minutes to fix. Together they cover the ways we most often see small businesses caught out in Microsoft 365. If you'd rather not go hunting through admin screens, Elevated IT can check all five for you and explain what we find in plain English. Call us on 1800 620 449.