Enhance Your Microsoft 365 Security with These Simple Steps

Picture this: one of your long-time customers emails your accounts team to say they've paid the latest invoice. The only problem is that the money went to a bank account you've never heard of. Somewhere along the way, a criminal got into a staff member's email, watched the conversations for a few weeks, and then sent your customer a perfectly timed message with "updated banking details."

For small and mid-sized businesses across Ontario, this isn't a far-fetched scenario. Business email is where invoices, payment approvals, contracts and client details all live, which makes it one of the most valuable targets an attacker can find. The good news is that if your business already uses Microsoft 365, two changes can make your email accounts dramatically harder to break into.

Passwords and MFA aren't the whole answer

Strong passwords and multi-factor authentication (MFA) are essential, and if you haven't turned on MFA yet, start there. But attackers have adapted. They use fake login pages that capture both the password and the MFA code, flood people with sign-in prompts until someone taps "approve" just to make them stop, or use older sign-in methods that skip MFA altogether.

The weak spot is that, out of the box, Microsoft 365 will let anyone with the right login details sign in from anywhere in the world, on any device. That's where the next two steps come in.

Step 1: Control how and where people sign in

Microsoft Entra ID P1 is a licence that adds a feature called Conditional Access to Microsoft 365. (If you're on Microsoft 365 Business Premium, it's already included. On other plans, it's an add-on.) Conditional Access lets you set rules for who can sign in, from where, and on what devices. For a typical Ontario business, that might look like:

• Block sign-ins from outside Canada, or from any country where you don't do business. Exceptions can be made for staff who travel.
• Require MFA for every sign-in, with no exceptions for "trusted" locations an attacker could imitate.
• Allow access only from company devices, so a stolen password is useless on an attacker's laptop.
• Block older sign-in methods that can't use MFA and are a favourite route in for attackers.

The result is simple: even if someone's password is stolen, the attacker is stopped at the door. For your team, nothing changes day to day. They sign in the same way they always have.

Step 2: Take the keys away from everyday accounts

In many small businesses, the owner, office manager or whoever first set up Microsoft 365 still has Global Administrator access on their everyday email account. It's convenient, but it's also risky.

Global Administrator is the highest level of access in Microsoft 365. It gives full control over every account, mailbox, file and security setting in your organization. If an attacker gets into one of these accounts, they don't just get one inbox. They can create new accounts, read anyone's email, turn off your security settings and lock you out of your own systems.

The fix follows a simple principle: give people only the access they need to do their job.

• Remove Global Administrator access from everyday accounts. The account you use to read email and browse the web shouldn't hold the keys to the whole company.
• Use limited roles where needed. Someone who manages billing or resets passwords can be given just that permission.
• Keep full admin access on separate, dedicated admin accounts, used only for admin work and protected by the strictest Conditional Access rules.

This is also what the Canadian Centre for Cyber Security recommends in its baseline security controls for small and medium organizations: limit administrator privileges and turn on MFA wherever you can. Your team keeps full access to their email, files and Teams. Only the master keys move somewhere safer.

A quick checklist for your business

• Is MFA turned on for every user, including the owner?
• Do you know which accounts have Global Administrator access, and does each one really need it?
• Are sign-ins limited to the countries where you do business?
• Have older sign-in methods been blocked?
• Is admin work done from a separate admin account?

If you answered "no" or "not sure" to any of these, it's worth a closer look. These changes are quick to put in place, they don't disrupt your team, and they close some of the most common doors attackers use.

Not sure where your business stands? The Attitude IT team can review your Microsoft 365 setup, show you who has admin access, and recommend the right Conditional Access rules for how your team works. Reach out to us at info@attitudeit.ca or call 905-432-7751.