Microsoft 365's defaults are built for compatibility, not maximum security — which means a new tenant leaves several of the settings that stop phishing and account takeover switched off. This checklist walks through the changes that matter most, in rough order of impact, with the actual policy and portal names, in plain language for the person who administers the tenant.
The highest-impact Microsoft 365 email hardening steps are: enforce multi-factor authentication for every account, block legacy authentication, and turn off external auto-forwarding. Then apply a Defender preset security policy, publish SPF, DKIM, and DMARC for your domain, and confirm unified audit logging is on so you can investigate later. Most account takeovers start with a stolen password on an account without MFA — close that door first, then work down the list.
Microsoft 365 ships to work smoothly for the widest range of customers, and some of its strongest protections are optional or need configuration. Every mailbox includes Exchange Online Protection, which filters spam and known malware — but out of the box a tenant does not necessarily enforce multi-factor login, block older insecure protocols, scan links at click-time, or stop a compromised account from quietly forwarding mail out of the organization. Those are the gaps attackers rely on, and the checklist below closes them.
The reassuring part: the two changes that matter most are free and fast. Microsoft has stated that requiring MFA and blocking legacy authentication together stop more than 99.9% of identity-based attacks, and that the large majority of password-spray attempts ride in over legacy protocols. You do not need the most expensive license to shut those down — you need to turn them on.
Almost everything here lives in one of four places. Knowing which is which saves most of the hunting:
Shortcut for small teams: rather than build each policy by hand, apply a preset security policy (Standard or Strict) in the Defender portal. It switches on anti-phishing impersonation protection, Safe Links, and Safe Attachments together, with Microsoft-maintained settings — the fastest way to a strong baseline.
These three records don't protect your inbox — they stop criminals from spoofing your domain to everyone else, which protects your customers, donors, and contacts as much as you. Set them up in order: SPF, then DKIM, then DMARC.
v=spf1 include:spf.protection.outlook.com -all).rua reporting address, and move it from none to quarantine to reject over time — watching the reports so you don't block a legitimate sender (a newsletter platform, an invoicing tool) you'd forgotten sends as you. A DMARC record with no reporting address leaves you flying blind, which is why so many organizations stall at none.When an account is taken over, the attacker's next move is almost always to set up a quiet way to keep reading or redirecting mail. Shut those down in advance:
If you only have a few hours, do them in this sequence — each one blunts a larger share of real attacks than the last is expensive:
Exchange Online Protection — anti-spam, anti-malware, spoof intelligence, the first-contact safety tip, and support for SPF, DKIM, and DMARC — is included in every Microsoft 365 plan. The advanced pieces (Safe Links, Safe Attachments, impersonation protection) come with Defender for Office 365 Plan 1, which is bundled into Microsoft 365 Business Premium and E5, or available as an add-on. For most small organizations, Business Premium covers essentially this entire checklist. Qualifying nonprofits can get Business Premium at a steep discount through Microsoft's nonprofit program — a reason not to skip these controls on budget grounds.
Every step above reduces the odds of an account being taken over, and that is worth a great deal. But it does not, on its own, stop business email compromise — the plain, link-free request for a wire transfer or a change of bank details that arrives from a real, compromised account and passes every check. That gap is closed by a payment-verification process, user awareness, and a layer that reads the intent of a message rather than just scanning it for malicious code. Treat hardening as the foundation, not the whole building.
Sources & further reading: Microsoft Learn — preset security policies, anti-phishing policies, DKIM and DMARC setup, and blocking legacy authentication · CISA SCuBA Exchange Online baseline · CIS Microsoft 365 Foundations Benchmark. Setting names and locations change; always confirm in your current admin center. Educational only, not a substitute for a professional configuration review.
Multi-factor authentication for every account, enforced through a Conditional Access policy or the built-in Security Defaults. Microsoft has said that MFA combined with blocking legacy authentication stops the overwhelming majority of identity-based attacks. Most Microsoft 365 account takeovers begin with a stolen or guessed password, and MFA closes that door. Turn it on before anything else.
No. Exchange Online Protection and Defender for Office 365 catch malicious links, malicious attachments, and known spam, but business email compromise usually carries none of those. When an attacker sends a plain-text request from a compromised but genuine account, it passes every built-in check. Hardening reduces account takeover; stopping the fraud itself also needs a payment-verification process and a layer that reads the intent of a message.
Yes. Legacy authentication protocols such as IMAP, POP, and older Office and Exchange clients cannot enforce multi-factor authentication, so attackers target them specifically to bypass MFA — the vast majority of password-spray attacks abuse legacy auth. Block it with a Conditional Access policy (or Security Defaults), and migrate any application that still requires it.
Every Microsoft 365 mailbox includes Exchange Online Protection, which handles spam, known malware, spoof intelligence, and the first-contact safety tip. Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments, and impersonation protection, and is included with Microsoft 365 Business Premium and E5. For most small organizations the upgrade is worth it — but you must configure the policies, because turning on the license alone does little. The easiest path is to apply the Standard preset security policy.
Microsoft signs outbound mail with a default key even if you never configure anything, but that is not the same as DKIM for your own domain. Proper DKIM requires publishing the two CNAME selector records for each custom domain and then switching DKIM signing on for that domain in the Defender portal. Until you do that per domain, your mail is not carrying a signature that others can verify as yours.
Aim for p=reject, but get there in stages. Start at p=none with an rua reporting address so you can see every service that sends as your domain, fix SPF and DKIM for the legitimate ones (including newsletter and marketing platforms), then move to p=quarantine and finally p=reject. If you jump straight to reject without watching the reports, you can block your own legitimate mail — which is why the reporting address matters as much as the policy.
No. For a small organization, Microsoft 365 Business Premium includes Defender for Office 365 Plan 1 and Entra ID Conditional Access, which cover almost everything on this checklist. E5 adds deeper investigation and hunting tools that larger or higher-risk organizations value, but the controls that stop the most common attacks are available well below that tier. Qualifying nonprofits can obtain Business Premium at a steep discount through Microsoft's nonprofit program.
Family Sentinel's Org Guard reviews your Microsoft 365 email posture, watches for the account-takeover signals that hardening is meant to prevent, and reads the intent of messages that pass every built-in check. Read-only, and never able to send or delete.