In a Swiss SME, Microsoft 365 concentrates almost everything that matters: mail, files, internal exchanges, often the calendar and contacts too. An attacker who obtains valid access to this environment no longer needs to force anything. They read, they wait, they choose their moment.
The good news is that most of the protections are already included in your subscription. The bad news is that they are not active by default, and no one is going to remind you.
Why isn’t the default configuration enough?
A Microsoft 365 subscription is delivered to work immediately, for everyone, without friction. That is a sound commercial choice: a product that blocks its users on day one does not sell.
This logic has a direct consequence. The default settings favour ease of use over protection. File sharing is broad, connections from anywhere are accepted, and detailed logs are not all enabled.
On top of this comes a common confusion about the division of responsibilities. Microsoft guarantees the security of its infrastructure and the availability of the service. Configuring your own environment, however, belongs to you: the accounts, the permissions, the access rules, the way your data leaves. Many business owners genuinely believe they bought a secure service. What they bought is a service that can be secured.
The subscription gives you good-quality locks. It does not close them for you, and it does not decide who gets a key. Almost all business e-mail compromises that SMEs experience exploit a configuration left at its default, not a flaw in the product.
Two-factor authentication, including for the administrator
This is the single most cost-effective measure on this whole list, and the only one that is truly non-negotiable. A password that has been stolen, guessed or leaked is no longer enough to get in if a second proof is required.
Two points are consistently missed.
Coverage must be total. Two-factor authentication applied to fourteen people out of fifteen protects fourteen people. The attacker specifically looks for the fifteenth, and finds them: often it is a director’s account that was granted an exception “because it’s a hassle while travelling”, or a shared address such as info@ that no one treats as a real account.
Admin accounts come first. These are the accounts that can create accounts, change rules, and read every mailbox. An admin account without two-factor authentication cancels out the benefit of every other measure. Also check how many accounts hold these rights: in many SMEs there are three or four for purely historical reasons, when two would be enough.
The detailed workings of the different methods, and how they differ in robustness, are explained in our article on two-factor authentication.
Legacy protocols, the door that bypasses everything
Here is the point that almost no SME is aware of, and which explains a large share of compromises despite two-factor authentication being enabled.
In some environments, Microsoft 365 still accepts old connection methods, inherited from mail software that predates the web era. These methods have a decisive characteristic: they cannot handle a second verification step. A login attempt that goes through this path presents a username and a password, and nothing else is asked of it.
In other words, you can have enabled two-factor authentication for everyone and still leave open an entry point that ignores it completely. Automated attacks test this channel en masse, precisely because it remains open at so many organisations.
The goal to set is simple: no authentication should be possible without going through the modern method. Implementing it requires first checking that no legacy equipment depends on these protocols, typically a multifunction copier that sends scanned documents by e-mail, or business software that sends out invoices.
How do you spot a compromised mailbox?
An attacker who has gained access to a mailbox does not announce themselves. Their interest is in staying as long as possible, reading, to understand who pays what and when. Yet they almost always leave the same trace.
This is the most reliable sign of a hijacked mailbox. The intruder creates a rule that copies to an external address every message containing "invoice", "IBAN" or "payment", then moves them into a folder no one opens. They keep reading everything even after a password change. Have the external forwarding rules on all your mailboxes listed: this check takes a few minutes and reveals intrusions that are months old.
Two other signs deserve monitoring. Successful logins from countries where you have neither clients nor staff, visible in the authentication logs. And two-factor authentication prompts that employees receive without having tried to log in themselves, a sign that someone already has the password and is knocking at the door.
This method of operating, and what it allows an attacker to do next, are detailed in our article on business e-mail compromise.
Are your files shared more widely than you think?
SharePoint and OneDrive let you share a document by generating a link. Two default settings cause problems.
The first is the type of link offered by default, which can grant access to anyone who has it, without authentication. It only needs to be forwarded once for it to escape your control.
The second is the absence of an expiry date. A link created for a one-off exchange stays active indefinitely, even after the supplier or client concerned is no longer involved.
The goal to ask for can be put in two sentences. The default link offered should target named people, not “anyone with the link”. External links should expire automatically after a reasonable period.
| What to achieve | Why | Who can do it |
|---|---|---|
| Two-factor authentication for everyone, no exceptions | Neutralises stolen passwords | Provider, or you with some help |
| Legacy authentication protocols blocked | Closes the two-factor authentication bypass | Provider, after an inventory |
| Admin accounts limited and protected | Reduces the most sought-after target | You, by deciding who needs the rights |
| Alert on new external forwarding rules | Detects a compromised mailbox in days, not months | Provider |
| Sharing links restricted and time-limited | Stops your documents circulating endlessly | Provider |
| Connection logging enabled and retained | Lets you understand afterwards what happened | Provider |
How do you check the current state without being an IT specialist?
You do not need to know how to configure anything to know where you stand. You need to ask the right questions and demand written answers.
How many of our accounts do not have two-factor authentication enabled, and which ones? How many accounts hold admin rights? Are legacy authentication protocols blocked? Which mailboxes have a forwarding rule to an external address? Do external sharing links expire, and after how long? For how long are connection logs retained? Ask for the answer in writing, with figures. "Everything is fine" is not an answer.
Microsoft also provides, within the admin centre, a security score that rates your configuration and suggests actions ranked by impact. It is not an audit, and a good score does not mean you are protected. It is, however, an excellent starting point for a factual discussion with your provider.
Alongside this, the e-mail check tool tells you in a few seconds whether your domain is correctly configured against impersonation, a related subject covered in our article on SPF, DKIM and DMARC.
What is best left to a professional
You can decide on your own who needs admin rights, require two-factor authentication everywhere, and ask the six questions above. That is already considerable, and it puts you ahead of most SMEs your size.
Three things, however, require someone who knows where to look. Blocking legacy protocols, because it first requires taking inventory of the equipment and software that depend on them, at the risk of interrupting your invoicing otherwise. Setting up conditional access rules, which adjust the level of scrutiny required based on the device and origin of the connection. And reviewing the permissions accumulated over the years on your file spaces, an exercise summarised in our article on access management.
One last point, often overlooked: Microsoft 365 retains your data, it does not back it up in the sense you probably mean. The recycle bin and version history have limited retention periods, and an item deliberately deleted can disappear for good. This question is covered in the 3-2-1 backup rule.
These settings form a genuine foundation, not a guarantee. Every environment carries its own habits and exceptions, and only a review of your configuration will tell you what is missing in your case. To gauge your overall level, the cyber check-up gives you a first measurement, and the Best practices pillar groups together the related measures.