Microsoft 365: five settings you should check in your business

Microsoft 365 is probably the tool your business uses most. Email, Teams, OneDrive and Office are in place from day one, but security and order don't happen on their own. Some settings you have to turn on, and others you should check are actually on. Here are five to tackle, and the licenses they require.

1. Two-factor for everyone, not just management

Microsoft says that two-factor authentication and blocking legacy sign-in methods stop over 99.9% of the most common attacks on user accounts. A stolen password isn't enough when the sign-in also has to be confirmed on your phone.

What to do: Check that security defaults are turned on in Microsoft Entra. They're free, and all users then have to register for two-factor with Microsoft Authenticator. Your account may already have them on, but it's worth checking. They also block legacy sign-in methods, so first check whether an older printer or business system sends email the old way.

2. Conditional Access: let the right person in from the right place

With Conditional Access, you set your own rules for when a sign-in is accepted. For example, you can reject sign-ins from countries your business never operates in. The feature comes with Microsoft 365 Business Premium, but not with Business Standard. It's one of the best reasons to upgrade.

What to do: Start with Microsoft's ready-made templates in Entra. They're created in a test mode, so you can see what the rules would have done before you turn them on. Microsoft recommends two emergency access accounts that are kept outside the rules, so you don't lock yourself out. The security defaults from step 1 must be turned off when the rules take over, since the two can't be used at the same time.

3. Backup of OneDrive and SharePoint

Many people think files in the cloud are protected automatically. But deleted files in OneDrive and SharePoint only stay in the recycle bin for 93 days. A folder deleted by accident, or ransomware that encrypts everything it can reach, may be discovered too late.

What to do: Move Desktop, Documents and Pictures on your PCs to OneDrive. Microsoft calls this Known Folder Move, and it can be rolled out centrally or turned on under Backup in the OneDrive settings. Your files are then safe if a PC goes missing, but it doesn't protect you against someone deleting the wrong file. If you need to restore email and files from further back in time, you need a separate backup, for example with Dropsuite.

4. Shared mailboxes instead of shared passwords

Addresses like post@, invoice@ and support@ shouldn't be a regular user whose password several people share. A shared mailbox needs no license of its own up to 50 GB, and employees open it with their own sign-in.

What to do: Convert your shared addresses to shared mailboxes, and give access to those who need it. Microsoft recommends keeping sign-in blocked on the mailbox account itself. When someone leaves, you remove their access without having to change any passwords.

5. A little order in Teams

Teams grows quickly, and without a few simple rules it soon becomes unclear who owns what, and where the agreement with the customer is stored.

What to do: Give every team at least two owners, and create a simple naming standard, such as "Customer – Name" and "Project – Name". It requires no extra license. With Business Premium, you can also let inactive teams expire. Teams in use are renewed automatically, the owners of the others get a notice, and a deleted team can be restored for 30 days.

Why you should consider Business Premium

You may see the pattern: Conditional Access and team expiration require Business Premium. Compared with Business Standard, you also get:

• Intune, which manages PCs and phones centrally.
• Defender for Business, which protects your PCs against malware and attacks.
• Defender for Office 365, which adds extra protection against phishing and dangerous email attachments.
• Retention policies, so files in OneDrive and SharePoint can be kept longer than the recycle bin's 93 days.

It costs more per user, but everything is in the same license. If you use Business Standard today, this is the first thing we'd look at. If you buy the licenses through us, they cost the same as buying directly from Microsoft.

What about Copilot?

Copilot is Microsoft's AI assistant in Word, Excel, Teams and Outlook. Whether it's worth the money depends on your workday. But clean up access permissions first. Copilot only shows content the user already has access to, and that includes everything that's been shared too widely.

Need a hand?

You can set up all five yourself, but the settings are spread across several admin centers. If you'd rather have someone else set it up and keep it maintained, that's what our Microsoft 365 service is all about. Get in touch, and we'll look at your setup together.