Microsoft 365 security for small businesses: what's on, what's off and what to check

Microsoft 365, which many people still call Office 365, comes with more protection than most small businesses realise, and less than many assume. On a business subscription, Microsoft switches on multi-factor authentication for everyone, blocks the older sign-in methods that attackers rely on and filters email for spam, malware and spoofed senders. What Business Basic and Business Standard don't include is protection against convincing impersonation emails, checks on links and attachments at the moment someone clicks, control over the laptops and phones your team uses, or rules about where and how people can sign in. Those come with Business Premium. Whichever plan you're on, the built-in settings only protect you while they're still switched on, so that's the first thing worth checking.

What does Microsoft 365 protect by default?

Every Microsoft 365 business plan includes a set of protections Microsoft calls security defaults. When they're active, everyone has to register for multi-factor authentication through the Microsoft Authenticator app, anyone with admin rights has to complete it every time they sign in, and ordinary users are asked for it whenever Microsoft judges a sign-in to be unusual, based on things like location, device and what they're trying to do. Security defaults also block older email and sign-in methods that can't handle a second check at all, which closes one of the routes attackers use to try stolen passwords at scale.

Alongside that, every mailbox gets Microsoft's built-in filtering for spam, malware and spoofed senders. According to Microsoft's own overview of the business plans, this is the same for Business Basic, Standard and Premium.

That combination deals with the attack small businesses meet most often. In the government's Cyber Security Breaches Survey 2025, 43% of UK businesses reported a breach or attack in the previous 12 months, and phishing was involved in 85% of those. A password tricked out of someone by a fake login page is far less useful to an attacker when the sign-in also needs an approval on that person's phone.

Why might security defaults be switched off?

There are two common reasons. Subscriptions created before 22 October 2019 didn't get security defaults automatically, and Microsoft only switches them on for older subscriptions that meet certain conditions. And anyone with admin access can turn them off, which tends to happen when something needs to work quickly: an old printer that scans to email, an app that can't cope with the extra sign-in step, or a member of staff who couldn't get the Authenticator app working before a deadline. Once they're off, nothing reminds you to turn them back on.

The same survey found that only 40% of UK businesses have two-factor authentication in place, so if you're not sure whether yours is on, you're far from alone. Whoever has admin access can see the setting in the Microsoft Entra admin centre, under Overview, then Properties, then Manage security defaults. If it's off, the next question is whether it was replaced with Conditional Access policies, which do the same job with more control, or simply switched off.

What doesn't Business Standard cover?

Business Basic and Business Standard stop at the built-in protection. Microsoft's comparison of the business plans shows four things that only arrive with Business Premium.

Defender for Office 365 Plan 1 adds impersonation protection, which looks for emails pretending to come from your managing director or a regular supplier, along with Safe Links, which checks a link at the moment someone clicks it rather than when the email arrived, and Safe Attachments, which opens attachments somewhere safe before they reach the inbox. Intune lets you require a passcode and encryption on the laptops and phones that hold company email and files, and wipe a lost one remotely. Defender for Business protects those laptops against malware and ransomware. And Conditional Access lets you set rules such as blocking sign-ins from countries you never work in, or only letting company devices open company files.

The impersonation gap matters most to whoever handles payments. The email asking your bookkeeper to change a supplier's bank details usually contains no malware at all. It contains a request, sent from a lookalike address or from a supplier's mailbox that has itself been taken over, and filtering built to catch spam, malware and spoofed senders can let a well-written request like that straight through.

Does a small business need Business Premium?

Not every business does. A team of eight working on company laptops that someone already looks after, with security defaults on and checked, can be well protected on Business Standard. Premium starts to earn its extra cost when people use their own phones or laptops for work email and files, when you handle client money, payroll or sensitive personal data, when a lost laptop would mean reporting a data breach, or when a client, insurer or Cyber Essentials assessment starts asking how you control the devices that access company data.

On that last point, the NCSC's Cyber Essentials requirements say that sign-ins to cloud services must always use multi-factor authentication, and that applies to Microsoft 365 like any other cloud service. The requirements also cover the devices that access company data, which is far easier to evidence when those devices are managed centrally.

The difference in price is per user, so it's worth working out for your own team rather than deciding on principle. Licences can also be mixed, so Premium can go on the people who handle money and data while everyone else stays on Standard.

What should you check in your Microsoft 365 this week?

None of these needs anything new buying, and each one points to a setting someone can check.

• Are security defaults on, or have they been replaced with Conditional Access policies that do the same job?

• Does everyone with admin rights use a separate admin login that isn't used for everyday email?

• Has every leaver from the last year been removed, and their licence reassigned or cancelled?

• Are there any inbox rules that forward mail outside the business or delete messages automatically?

• Can staff share files with anyone who has the link, and is that what you want?

• If your main IT contact left tomorrow, would someone else know how to get admin access?

If you couldn't answer more than one of these with confidence, the risk has less to do with which licence you're on and more to do with whether anyone is looking after the settings.

What to look for in whoever manages your Microsoft 365

Whether you use an outside team or someone in-house, ask them to confirm in writing which security settings are switched on and how often they're reviewed. Ask who answers when someone is locked out at 8am and how quickly, because multi-factor authentication only stays switched on if lockouts get sorted fast. Check whether adding a new starter or removing a leaver is included in the monthly price or charged each time, and whether licences are reviewed so you stop paying for people who've gone. If Cyber Essentials is on your list, ask whether they've taken a business through it before.

Most people now shortlist providers through Google, AI assistants and recommendations from people they trust, which makes it easy to collect claims and harder to test them. Asking for a named client you can speak to, and for the exact wording of the response time they commit to, tells you more than a features list.

This kind of ongoing care suits businesses that rely on Microsoft 365 every day and want one team to own it. If you only need help with a personal or family subscription, Microsoft's own support is the right place to go.

The short version

Microsoft has done more of the security work for small businesses than it used to, and most of the risk now sits in settings that were switched off, never reviewed or left behind when someone moved on. If you do one thing this week, ask whoever has admin access to check that security defaults or Conditional Access are on for every user, and to show you the leavers who still have a login.

Our Microsoft 365 page sets out what our monthly management covers, from £8.50 per user a month including a Business Basic licence or £15.50 with Business Standard, and how we set up and keep these security settings under review for every business we look after.