1. Multi-factor authentication for everyone
MFA (a prompt in the Microsoft Authenticator app, or a passkey) blocks the vast majority of account takeovers. On smaller plans, Microsoft's security defaults switch it on for everyone in one go. On Business Premium you get finer control with Conditional Access.
2. Separate admin accounts
Don't use the account you read email with to run the whole organisation. Give admin rights to a separate admin account that's used only for admin work, and keep a second emergency admin account, securely stored, so you can't be locked out.
3. Check for sneaky forwarding rules
When attackers get into a mailbox, they often add a rule that forwards or hides certain emails — invoices, payment requests — so they can redirect payments without you noticing. Check Outlook → Settings → Mail → Rules and Forwarding on every mailbox now and again, and block automatic forwarding to outside addresses unless you really need it.
4. Turn off old sign-in methods
Older email protocols (“legacy authentication”) can't do MFA, so attackers love them. Security defaults block them; if you've turned security defaults off, make sure they're blocked another way.
5. Keep it tidy
- When someone leaves, block their sign-in the same day and convert their mailbox to a shared one if you need it.
- Give people only the access they need.
- Run the free Microsoft Secure Score now and then — it lists what's left to improve.
