Microsoft 365 for SMEs: Are You Getting the Security Your Business Is Paying For?

/in , , /by

Every Microsoft 365 subscription comes with a set of security tools built in. Most of them sit there unused.

It’s an easy thing to miss. You buy the licence, set up the mailboxes, the team gets going, and somewhere along the way you assume the protection came bundled in. Some of it did. Plenty of it’s still sitting there, waiting for someone to switch it on.

For SMEs running Microsoft 365 across London and the surrounding area, that gap matters. You are paying for capability you may not be using, and the unused parts are often the ones that would stop an attacker getting in.

The Security You Have Already Bought

A Microsoft 365 subscription goes beyond email and Office apps. Depending on your plan, it includes identity protection, access controls, threat policies and audit tools that many businesses never touch.

Microsoft runs a shared responsibility model, meaning they keep the platform itself patched and available while you configure what happens inside your own tenant, including who can sign in and what they can reach.

Default settings are designed for a smooth start rather than a hardened finish, so the tools you have paid for tend to stay in their out-of-the-box state. The ones most often left untouched include:

  • Multi-factor authentication (MFA) that has not been enforced for every account
  • Conditional access rules that could limit risky sign-ins but were never built
  • External sharing and guest access left open by default
  • Audit logging switched off or switched on and never reviewed

None of these draw attention to themselves, which is why the gap goes unnoticed for months.

MFA and Why It’s Still Not Universal

MFA is one of the most effective controls available to a Microsoft 365 tenant, and it’s included in every plan. But it’s still not switched on everywhere it should be.

Part of the reason is friction. Enforcing it for every user takes a deliberate decision, and there is usually one account, often an admin or a senior leader, that someone decides to leave exempt. That exemption tends to be precisely the account an attacker wants.

This matters because of how most breaches begin. The government’s Cyber Security Breaches Survey 2025/2026 found that phishing was the most common type of attack, experienced by 38% of businesses.

Phishing works by capturing a password. With MFA enforced, that stolen password on its own isn’t enough to get anyone in.

Conditional Access, Guest Permissions and Admin Accounts

Beyond MFA, a handful of areas build up risk over time without anyone deciding they should:

  • Conditional access: This lets you set the conditions under which a login is allowed, such as blocking sign-ins from countries your staff never work in or requiring a managed device. The capability is there in most business plans but often goes unbuilt.
  • Guest permissions: External sharing links and guest accounts accumulate as projects come and go. Few businesses can say exactly what is currently shared and with whom.
  • Admin accounts: An admin account can change security settings and reach everyone’s data, which makes each one a prime target. Many tenants carry far more admins than they need.
  • Dormant accounts: Logins belonging to people who have left often stay live, handing an attacker a valid account that nobody is watching.

Each of these is manageable once someone has eyes on it. The difficulty is that they rarely get reviewed once the initial setup is done.

Connecting Microsoft 365 to Dark Web and Credential Monitoring

Even a well-configured tenant has its blind spots. It only sees what goes inside it, so it has no way of knowing when one of your staff has had a password caught up in a breach elsewhere on the internet.

Reused passwords are more common than you think. When a member of staff uses the same password for a work account and a personal account that later gets breached, those stolen credentials end up traded on the dark web. From there they get tested against business logins in bulk.

Dark web and credential monitoring watches for your domain and your users’ details appearing in known breach data. Paired with Microsoft 365, it means a leaked password can be flagged and reset before it is used against you.

This is the layer that connects what Microsoft 365 protects with what is happening beyond it.

Security Set Once Does Not Stay Secure

Just because your tenant is configured well today doesn’t mean it can’t be exposed within a year. Staff join and leave, new apps get adopted, permissions get granted for a one-off task and never removed, and Microsoft changes its own features and defaults along the way.

Getting the most from Microsoft 365 depends on treating cyber security as something maintained on an ongoing basis. In practice that means the following:

  • Keeping MFA and conditional access enforced as accounts change
  • Reviewing admin roles and permissions so privilege stays tight
  • Monitoring sign-ins for activity that looks out of place
  • Keeping external sharing and guest access controlled
  • Running independent backups, since Microsoft 365 does not protect your data from accidental deletion or ransomware on its own
  • Watching for leaked credentials through dark web monitoring

At 4TC, we work with SMEs across London and Hertfordshire to keep Microsoft platforms secure and well managed, so the tools you are paying for stay switched on and doing their job as the business grows.

Speak to 4TC About Your Microsoft 365 Environment

Want to make sure your Microsoft 365 environment is properly configured and protected? Speak to the 4TC team today. We work with SMEs across London and Hertfordshire to keep Microsoft platforms secure and well managed.

FAQs

  1. Is Microsoft 365 secure by default?
    Not fully. Microsoft 365 includes strong security tools, but many, including MFA and conditional access, stay switched off until someone enables them. Microsoft secures the underlying platform, while the settings inside your tenant are yours to configure.
  2. What security features do most Microsoft 365 for UK businesses leave unused?
    The most commonly unused features are enforced MFA on every account, conditional access policies, controlled external sharing, and audit logging. These come included in the licence that most Microsoft 365 for UK businesses already pay for, yet they often sit inactive.
  3. How does dark web monitoring work with Microsoft 365?
    Dark web and credential monitoring checks whether your users’ details have appeared in known data breaches. When a leaked password is found, it can be reset before an attacker uses it against your Microsoft 365 accounts, closing a gap the platform cannot see on its own.
  4. Can a managed IT provider help with IT security in London?
    Yes, a provider offering IT security in London can audit your tenant, enforce MFA and conditional access, review permissions and add monitoring, then keep everything maintained as your team changes.
  5. Does better Microsoft 365 security mean paying for a higher licence?
    Often not. Much of what protects a Microsoft 365 tenant, including MFA and basic conditional access, is already part of the business plans most SMEs hold, so the first step is activating what you have rather than upgrading. A higher tier can be worth it for advanced threat protection or compliance features, but it’s worth confirming what your current licence covers before spending more.

Is Your Microsoft 365 Setup Actually Secure? What Most London SMEs Get Wrong

/in , , /by

It all looked right. The logins worked, email started flowing, the files moved across without a hitch, and Microsoft 365 was declared ready to go.

That moment, when everything works and nobody touches the settings again, is exactly where the risk begins.

Microsoft 365 is one of the most capable platforms a small business can run on. It’s also one of the most heavily targeted, and the version most London SMEs are actually running isn’t configured to defend itself the way its owners assume it is.

Let’s explore the common misconfigurations and how Microsoft 365 security can be kept in good shape with the right managed IT in London behind it.

Why Default Microsoft 365 Settings Are Not the Same as Secure Settings

A Microsoft 365 licence gives you the tools to be secure, but it does not switch them all on for you.

Microsoft operates a shared responsibility model. That means they keep the platform itself running and patched, but everything inside your tenant is yours to configure. This includes who can log in, how they prove it’s them, what can be shared externally, and which old protocols stay open.

Default settings are built for a smooth start. Hardening the environment tends to add small frictions, so it rarely happens on its own. A few things are commonly left in their out-of-the-box state:

  • Multi-factor authentication (MFA) not enforced for every user
  • Legacy authentication protocols still enabled, which let attackers sidestep MFA entirely
  • External sharing is left permissive, so files can leave the business more easily than anyone intends
  • Audit logging switched off or switched on and never reviewed

None of these announce themselves, which is precisely why the gaps go unnoticed.

The Most Common Misconfigurations SMEs Don’t Know They Have

These issues show up repeatedly across London businesses, but they’re rarely the result of carelessness. They’re usually the natural consequence of a setup that was done once and never revisited.

From April 2026, the UK’s Cyber Essentials scheme made MFA mandatory across every cloud service that supports it, Microsoft 365 included.

Under the updated v3.3 requirements, a single in-scope account without MFA is now an automatic fail. The change, set by the NCSC and administered by IASME, reflects how routinely unprotected cloud logins are still being exploited.

The usual suspects include the following:

  • Too Many Global Admins: Admin accounts can change security settings and reach everyone’s data, so each one is a prize target. Many tenants have far more than they need, sometimes shared between staff.
  • MFA Gaps: MFA is often enabled for some people but not all, or not required for the admin accounts that matter most.
  • Over-Permissive Sharing and Guest Access: External sharing and guest links accumulate over time, and few businesses can say exactly what is currently shared or with whom.
  • Inactive Accounts Left Enabled: Leavers’ logins stay live, giving attackers a valid account that nobody is watching.
  • Incomplete Email Authentication: SPF, DKIM and DMARC are often half-configured, which leaves your domain open to spoofing and impersonation.
  • “Set and Forget” Configuration: A tenant judged secure three years ago may be exposed today, because features, threats and best practice have all moved on.

What Attackers Look For in a Poorly Configured Microsoft 365 Tenant

Attackers think in terms of effort. Microsoft 365 is appealing because so many tenants look almost identical, so a technique that works against one often works against hundreds.

Automated tooling sweeps thousands of targets at once, which is how a small London business ends up caught in the same net as a large one. Attackers often probe for:

  • A login without MFA, which can be cracked with bulk password guessing
  • Legacy authentication that stays open and ignores MFA altogether
  • Over-privileged accounts that hand them the keys to the whole tenant if compromised
  • Inbox and forwarding rules they can add to syphon off email once inside

The reassuring part is that the most common entry point is also the most preventable. Identity attacks are usually password-based, so properly enforced MFA shuts out the vast majority of them.

How Proactive IT Management Keeps Microsoft 365 Secure on an Ongoing Basis

Security drifts over time as your staff, tools and work processes change. That’s why it’s so important to regularly review your Microsoft 365 environment.

Proactive managed IT in London turns security into an ongoing discipline. In practice, that means:

  • Enforcing and maintaining MFA and conditional access across every account
  • Reviewing admin roles and permissions so privilege stays tight
  • Monitoring sign-ins for unusual activity, such as logins from places your staff have never been
  • Keeping external sharing and guest access controlled as teams change
  • Running independent, tested backups, because Microsoft 365 does not protect your data from accidental deletion or ransomware

At 4TC, we work with businesses across London and Hertfordshire to keep Microsoft 365 secure as standard practice, so the environment stays hardened as the business grows and changes.

A Simple Self-Audit Checklist for Business Owners

You don’t need to be technical to get a rough sense of where you stand. Run through these questions:

  • Is MFA switched on for every user, including all admins?
  • Do you know how many global admin accounts you have? It should be a small handful.
  • Is legacy authentication disabled?
  • Do you know what can currently be shared externally, and with whom?
  • Are former employees’ accounts fully disabled, not just hidden?
  • Is your Microsoft 365 data backed up independently of Microsoft?
  • Has anyone reviewed your tenant’s security settings in the past 12 months?

If you hesitated on any of these, that is your starting point.

Not sure if your Microsoft 365 setup is as secure as it should be? Get in touch with the team at 4TC for a no-obligation review.

FAQs

  1. Is Microsoft 365 secure by default?
    Not fully. While Microsoft secures the underlying platform, Microsoft 365 security inside your own tenant, including MFA, sharing rules and admin permissions, is your responsibility to configure. Default settings prioritise a smooth setup, so several protections stay switched off until someone turns them on.
  2. What is the single most important step to secure Microsoft 365?
    Enforcing MFA for every user, admins included, and disabling legacy authentication so it cannot be bypassed. This prevents the most common attack against Microsoft 365 accounts. Sensible admin permissions and controlled external sharing come next.
  3. How does managed IT in London help secure Microsoft 365?
    Managed IT in London gives you a consistent process for hardening your tenant and keeping it that way. That includes enforcing MFA and conditional access, monitoring sign-ins, reviewing permissions and running independent backups.
  4. How often should a business running Microsoft 365 in London review its security settings?
    At least once a year as a baseline, and whenever there is a meaningful change such as new starters, leavers or newly adopted apps. Threats and Microsoft’s own features change continually, so a tenant configured a few years ago may now be exposed without anyone realising.