Microsoft 365 Hardening: What to Fix First

Microsoft 365 hardening means reducing the easy paths into your email, files and administrator accounts. For most businesses, the first jobs are multi-factor authentication, administrator access, old sign-in methods and email forwarding rules.

That order matters. A business can buy more Microsoft licences, turn on a dozen settings and still leave one shared admin account, a weak recovery method or an inbox rule that sends invoices to a criminal.

For a 10-person accounting firm, an NDIS provider or a warehouse with Microsoft email, the aim is practical control. You want fewer ways for an account to be taken over, clearer alerts when something changes, and a recovery process that works when a staff member loses a mobile or leaves suddenly.

What is Microsoft 365 hardening?

Microsoft 365 hardening is the work of changing Microsoft 365 settings, account permissions and operating practices to reduce avoidable security exposure. It covers identity, email, devices, file sharing, audit records and the people who can change them.

It is not one switch in the Microsoft 365 admin centre. It is also not a compliance certificate or a guarantee that fraud will not occur. A determined attacker, a compromised supplier and a staff member who approves the wrong payment can still create a serious incident. Hardening reduces common openings and gives your business a better chance of spotting and containing a problem early.

The right level depends on what you hold. A sole trader using email and OneDrive needs a different setup from a 120-person practice handling tax records, payroll files and client bank details. The basics are similar. The approval process, monitoring and device controls should reflect the consequences of a compromised account.

Why do businesses get caught with basic settings?

Microsoft 365 is designed to be usable from day one. That is helpful when a new business needs email this afternoon. It also means settings are often left in place as staff numbers grow, contractors are added, and the person who set up the tenant moves on.

We regularly see several administrator accounts with no clear owner, former staff still listed as recovery contacts, and shared mailboxes with broad access. Another common issue is legacy authentication. Older sign-in methods may bypass modern multi-factor authentication controls or create a less visible route into an account.

Email fraud adds another pressure point. A criminal does not always need malware. They may sign into a mailbox, create a hidden forwarding rule, watch invoice conversations, then send altered payment details at the right moment. Microsoft 365 hardening should therefore include mailbox rules, external forwarding and payment-change procedures, not just password settings.

Which Microsoft 365 hardening controls come first?

Start with identity. If someone can sign in as an administrator, they may be able to reset passwords, approve devices, read mail, alter sharing settings and create new accounts. The following controls give most small and mid-sized businesses a sensible first pass.

Are all users using multi-factor authentication?

Require multi-factor authentication for every user, including directors, contractors and shared administrative users. Use the Microsoft Authenticator app or another approved method that your business can support. SMS is better than a password alone, but app-based verification is generally less exposed to phone number takeover and message interception.

Do not stop after enabling MFA. Check that users have more than one recovery method where appropriate, and confirm who can reset those methods. A recovery process that relies on a former office manager's mobile is not a recovery process.

High-risk users need extra care. Finance staff, payroll staff, executive assistants and administrators are frequent targets because their accounts can move money or approve changes. Conditional Access policies can require stronger sign-in conditions for these roles, such as blocking access from unmanaged devices or prompting again when risk changes. The exact policy needs testing first. A rule that blocks a director from urgent travel access may be technically correct but commercially unhelpful.

Who has administrator access?

List every account with an administrator role and remove rights that are not needed. Most staff do not need global administrator access. Day-to-day support tasks can usually use narrower roles, which limits what a compromised support account can change.

Keep at least two emergency access accounts under controlled ownership. These accounts should be protected with strong, documented authentication and stored recovery details. They are for a real lockout event, not everyday work. Test the process carefully and record who is authorised to use them.

Avoid shared administrator accounts where possible. Named accounts create a clearer audit trail and make offboarding easier. If a shared account cannot yet be removed because of an old system or vendor requirement, document why it exists, who knows the credentials and the date it will be reviewed.

Can old sign-in methods and external forwarding be blocked?

Disable legacy authentication where your applications allow it. Before doing so, identify older scanners, accounting add-ins, mobile apps or line-of-business tools that may still rely on it. Fix the process first, then automate or restrict it. Otherwise, a security change becomes an avoidable Monday morning outage.

Review automatic external email forwarding as well. In many businesses, users have no reason to forward every message to a personal mailbox or external address. Blocking broad external forwarding reduces one common way confidential correspondence leaves the tenant without notice. There can be valid exceptions, such as a monitored service mailbox connected to an approved platform. Those exceptions should be specific, approved and reviewed.

Check inbox rules and delegated mailbox permissions. Look for rules that move finance emails, mark messages as read, forward content externally or hide incoming mail in unusual folders. Review who can send as a director, accounts payable mailbox or shared sales address. These are small settings with large consequences.

Are email impersonation and malicious attachments being handled?

Configure Microsoft Defender for Office 365 features available in your licence, including anti-phishing, anti-spam and attachment controls. The settings need to match the business. A law firm may accept more attachment types from known clients than a café with simple supplier invoices. Too strict, and staff will work around the controls. Too loose, and obvious threats land in inboxes.

Use clear external sender labelling if it suits your workflow. It gives staff a visible prompt that an email claiming to be from a director or supplier originated outside your organisation. It is not proof that the message is fraudulent, and it should not replace payment verification.

For payment detail changes, set a process outside email. Call a known number already held in your records, not the number in the message. This is an operational control, not an IT setting, and it is often one of the most useful defences against business email compromise.

What about devices, files and Teams sharing?

Accounts are only part of the picture. A signed-in laptop with no screen lock, no supported operating system or no disk encryption can expose data even when MFA is working correctly. Use device management where it fits your environment to require a PIN, encryption and supported software versions. For businesses with staff using personal devices, decide what access is acceptable rather than pretending those devices do not exist.

Review external sharing in SharePoint, OneDrive and Teams. Many businesses need to share a folder with an accountant, subcontractor or customer. The safer approach is named access with an expiry date where practical, rather than anonymous links that can be forwarded indefinitely.

Check who owns Teams and Microsoft 365 groups. Groups without a current owner tend to accumulate members and files without anyone reviewing access. When staff leave, remove their account, transfer required mailbox and file ownership, revoke active sessions, and check their group memberships. Offboarding should happen on the departure date, not when someone gets time next week.

How often should you review the setup?

Review key Microsoft 365 settings quarterly, and review administrator roles, new forwarding rules and suspicious sign-ins more often. The right frequency depends on your staff turnover, data sensitivity and how often you change systems.

Keep a short record of decisions: who owns the tenant, where emergency credentials are held, which exceptions exist, and who approves access to finance mailboxes. This is more useful than a 60-page policy nobody opens. If an insurer, tender panel or larger customer asks what controls are in place, you can provide a clear account of what you actually do.

Do not rely on a dashboard alone. Reports can show that MFA is enabled, but they cannot tell you whether the recovery contacts are current, whether an exception still has a business reason, or whether staff follow the payment-change process. No dashboard promises until we've seen your data and how people work.

When should you bring in help for Microsoft 365 hardening?

Bring in help when nobody owns the tenant, an incident has exposed gaps, a customer or insurer needs evidence of controls, or changing settings could interrupt critical email and applications. You may not need ongoing managed IT for a small, stable setup with a capable internal owner. You do need someone accountable for the changes, reviews and exceptions.

Sharktech Global can scope Microsoft 365 hardening as part of cybersecurity and managed IT work. The work is scoped and priced up front, with attention to the Microsoft licences you already have, the devices people use and the business processes attached to email. It does not include an Essential Eight assessment, penetration testing or a compliance certification outcome.

Start with the accounts that can approve payments, read client records or change Microsoft 365 settings. Make those accounts harder to misuse, write down who owns the exceptions, and schedule the next review before the first one is forgotten.

How Sharktech can help

Want a second opinion on your setup? Our cyber security team runs health checks for Australian businesses, and our managed IT services keep the fixes in place. Book a call to get a clear list of what to fix first.