A Simple, Free Way to Secure Your Office 365 Email Account
Most email compromises we're called into didn't involve anything clever. Someone's password was guessed, reused from a breached site, or handed over on a convincing-looking sign-in page. The attacker then sat quietly in the mailbox reading invoices.
The single control that stops nearly all of it is free, built into every Microsoft 365 plan, and takes about ten minutes to enable: multi-factor authentication.
Why a password on its own isn't enough
A password is one thing you know. If someone else learns it, they are you. And they learn it more easily than most people assume:
- Reuse. The same password on a hobby forum that got breached three years ago.
- Phishing. A fake Microsoft sign-in page that captures whatever you type. These are convincing now, correct branding, correct URL structure, valid certificate.
- Guessing at scale. Automated attempts against every mailbox on your domain, running constantly in the background.
Once inside a mailbox, the usual pattern is patient: create a hidden inbox rule, watch for an invoice conversation, then send an "updated bank details" email from your real account to your real customer. Nothing about it looks wrong to the recipient.
What MFA does
MFA adds a second factor, something you have. When someone signs in with your password from a new device, Microsoft asks for a code or an app approval. The attacker has the password but not your phone, so the sign-in fails and you get a notification that someone tried.
It is not perfect. Attacks that relay approval prompts exist, which is why number matching (now on by default) and conditional access policies matter. But it removes the overwhelming majority of the automated and opportunistic attacks that make up most real-world compromises.
How to turn it on
For a small tenant, the quickest route is security defaults, which enforce MFA for all users including admins:
- Sign in to the Microsoft 365 admin centre as a global administrator.
- Go to the Microsoft Entra admin centre, then Identity, Overview, Properties.
- Select Manage security defaults.
- Set it to Enabled and save.
Users will be prompted to register the Microsoft Authenticator app the next time they sign in.
For larger or more complex tenants, use conditional access policies instead. They give you finer control, for example, requiring MFA from outside the office but not from a compliant, managed device, and they let you set stronger rules for administrators than for standard users.
Before you flip the switch
- Tell people first. An unannounced MFA rollout generates a wall of helpdesk calls.
- Sort the shared mailboxes and service accounts. Anything using basic authentication or a hardcoded password will break. Find these before, not after.
- Check old devices and applications. Legacy mail clients and some line-of-business apps don't support modern authentication.
- Register a backup method. A second factor tied to a single phone that gets lost is its own problem.
The other free things worth doing the same afternoon
While you're in there:
- Disable legacy authentication. It bypasses MFA entirely. Blocking it is free and closes the biggest gap.
- Check for suspicious inbox rules. Rules that forward externally or move messages to RSS Feeds are a classic compromise sign.
- Turn on unified audit logging so you have something to investigate with if it does happen.
- Review who holds global admin. It should be a small number of named accounts, ideally separate from day-to-day mailboxes.
- Look at your spam and phishing posture, our notes on reducing spam emails cover the filtering side.
Backup is a separate question
Enabling MFA protects access. It doesn't protect the data. Microsoft's agreement covers service availability, not recovery from your own deletion or a ransomware event syncing through OneDrive, which is why you're responsible for protecting your Office 365 data, and why third-party backup such as Acronis sits alongside it.
Where this fits
MFA is one of the five controls in Cyber Essentials, and it's the first thing we check on any new managed IT support client. It's also the cheapest item on the list in our guide for small businesses.
If you'd rather someone else handled the rollout, the conditional access policies and the legacy authentication clean-up, our cloud support team does this routinely across Birmingham, Solihull and Worcester. Formal assessments sit under cyber security consultancy.
Book a call if you want your tenant checked over, we'll tell you what's exposed and what to fix first.
While you']re tightening up mailbox settings, it']s worth knowing how to recall an email in Outlook, sending something to the wrong recipient is one of the most common data-exposure incidents we see.
