Microsoft 365 Security - Franklin Web Technologies

MFA vs Conditional Access: What Does Your Small Business Actually Need?

analytics11 — Tue, 08 Sep 2026 18:00:00 +0000

Small businesses often need more than a simple password to protect Microsoft 365 accounts, but adding every available control can create unnecessary cost and complexity. The practical answer to MFA vs Conditional Access is that they serve different purposes: multi factor authentication verifies a user’s identity with an additional factor, while Conditional Access decides when and under what conditions that user can access a resource. Many businesses should start with MFA and add Conditional Access as their access rules become more specific. Franklin Web Technologies can help businesses assess which controls fit their Microsoft 365 environment and day-to-day access needs.

MFA and Conditional Access Solve Different Problems

MFA and Conditional Access are sometimes treated as competing options, but they are better understood as two layers of access control.

MFA asks, “Can this person prove they are the account owner?” A user may enter a password and then approve a sign-in through an authenticator app, use a security key, or provide another approved verification method. The additional step makes a stolen password less useful on its own.

Conditional Access asks, “Should this person be allowed to sign in under these specific circumstances?” It can evaluate signals such as the user, application, device, location, and sign-in risk before applying an access decision.

That distinction matters for small businesses. MFA provides a strong baseline for account protection. Conditional Access gives administrators more control over the circumstances in which access is permitted, blocked, or subject to an additional requirement.

What Does MFA Actually Do?

Multi factor authentication adds another verification requirement to the login process. Instead of relying only on a password, the user must provide another approved factor.

For example, an employee might enter their password and then approve a notification in Microsoft Authenticator. If someone obtains the password but cannot complete the second verification step, the login attempt can be stopped.

MFA is especially useful for businesses that want a practical improvement without creating a large set of access rules. It can help with:

Reducing the value of stolen passwords
Improving Microsoft 365 login protection
Supporting account takeover prevention
Adding an extra identity check for employees and administrators

MFA should generally be considered a baseline control for Microsoft 365 accounts, particularly for accounts with access to email, files, financial information, customer records, or administrative settings.

However, MFA does not by itself decide that a familiar user on an unmanaged device should be blocked from accessing sensitive information. That requires additional access policies.

What Does Conditional Access Add?

Conditional Access provides policy-based control over access to Microsoft cloud resources. Microsoft 365 administrators can create rules that evaluate the circumstances surrounding a sign-in and then apply a requirement.

For example, a business could require MFA for administrative accounts, block access from specific locations, or require an approved device for access to certain applications.

A Conditional Access policy can be designed around several signals, including:

Users and groups: Apply different rules to administrators, contractors, executives, or general employees.

Cloud applications: Apply stricter requirements to selected Microsoft 365 services or applications.

Device conditions: Require a compliant or managed device for specific resources.

Location: Apply different controls to trusted and untrusted network locations.

Risk signals: Use risky login policies to respond to sign-in or user risk signals when the appropriate Microsoft Entra capabilities and licensing are available.

This makes Conditional Access particularly useful for businesses with employees working from different locations, using company-managed devices, accessing sensitive resources, or handling different levels of information.

MFA vs Conditional Access: A Practical Comparison

The simplest way to distinguish the two is to think of MFA as an identity verification control and Conditional Access as an access decision framework.

Factor	MFA	Conditional Access
Main purpose	Verify the user’s identity with an additional factor	Apply access rules based on sign-in conditions
Primary question	“Is this really the user?”	“Should access be allowed under these conditions?”
Password protection	Strong	Strong when combined with MFA
Device-based rules	Limited on its own	Yes
Location-based rules	No	Yes
Application-specific rules	Limited	Yes
Risk-based policies	Not the main function	Yes, with supported Microsoft Entra capabilities
Ease of deployment	Generally simpler	Requires policy planning and testing
Best starting point	Most businesses	Businesses needing more precise access controls

The two controls are not normally an either-or decision. Conditional Access can actually be configured to require MFA when certain conditions are met.

When Should a Small Business Use MFA?

MFA is the logical starting point for a small business that currently relies heavily on passwords.

Consider a 12-person accounting firm where employees use Microsoft 365 email, OneDrive, and Teams. Staff work primarily from company-managed laptops and do not need different access rules for different locations.

The business may not need a large collection of access policies immediately. Requiring MFA for user accounts can provide a significant improvement while keeping administration manageable.

MFA is also useful when:

Your main concern is stolen passwords. MFA adds another verification step after the password.

You need a simple baseline. Businesses without dedicated IT staff may benefit from beginning with a straightforward control.

Most employees have similar access needs. If users generally access the same services under similar conditions, complex policies may not provide much additional value at first.

You are securing administrative accounts. Administrator accounts deserve particularly strong login controls because they can affect other users, applications, and settings.

When Does Conditional Access Make More Sense?

Conditional Access becomes more valuable as a business needs to distinguish between different access situations.

Imagine a 40-person consulting company with employees working from offices, client locations, and home. Staff use company laptops, but contractors occasionally need access to selected Microsoft 365 resources.

A single MFA requirement does not address every access scenario. The company may want employees using approved devices to access internal resources normally while applying stricter requirements to unmanaged devices or higher-risk sign-ins.

Conditional Access can help create those distinctions.

It is a strong fit when your business needs:

Different rules for different users. Administrators and contractors may require different access conditions.

Device controls. Access to selected resources can depend on device compliance or management status.

Application-specific requirements. Sensitive applications can receive stricter policies than general services.

Location controls. Certain access attempts can receive additional requirements or be blocked based on configured locations.

Risk-based decisions. Supported Microsoft Entra risk signals can help organizations apply additional controls to suspicious sign-ins.

For businesses using Microsoft 365 extensively, Conditional Access Microsoft 365 policies can provide much more precise control than a single MFA requirement.

Real SMB Scenarios

A Small Retail Business

A 10-person retailer uses Microsoft 365 for email, calendars, and documents. Employees work from one primary location and use a mix of company and personal devices.

Recommended starting point: MFA for all users, with stronger protection for administrator accounts.

Conditional Access can be considered later if the business needs device restrictions, location rules, or different access requirements.

A Professional Services Firm

A 30-person firm has employees working remotely and from client offices. Some users regularly access confidential client documents.

Recommended approach: MFA plus carefully designed Conditional Access policies.

The business could require MFA for users, apply device requirements to sensitive resources, and create additional controls for administrative accounts.

A Business With Contractors

A small technology company uses employees and external contractors. Contractors only need access to selected Microsoft 365 resources.

Recommended approach: MFA combined with Conditional Access.

Conditional Access can help apply different access requirements to contractor accounts and restrict access to selected applications.

A Business Concerned About Risky Sign-ins

A business has noticed unusual login activity and wants additional controls beyond standard MFA.

Recommended approach: MFA plus risk-based Conditional Access policies, using supported Microsoft Entra capabilities and appropriate licensing.

The objective is not simply to add more prompts. It is to make access decisions based on the conditions surrounding a sign-in.

SMB Decision Matrix

Use this matrix to identify the most appropriate starting point:

Business situation	MFA	Conditional Access	Recommended approach
Password-only Microsoft 365 accounts	High priority	Not required initially	Start with MFA
Small team with similar access needs	High priority	Optional	MFA may be sufficient
Remote employees using different devices	High priority	High priority	Use both
Contractors need limited access	High priority	High priority	Use both
Sensitive applications need stricter rules	High priority	High priority	Use both
Device compliance matters	High priority	High priority	Use both
Risk signals need policy-based responses	High priority	High priority	Use both where supported
Business has very limited IT administration	High priority	Add gradually	Begin with MFA

The matrix points to a useful rule: MFA is usually the starting control, while Conditional Access becomes valuable when the business needs context-based access decisions.

How to Avoid Overcomplicating Conditional Access

Conditional Access can be powerful, but poorly planned policies can create access problems. A business should avoid creating numerous rules simply because the technology allows it.

Start by identifying the accounts, applications, devices, and access situations that matter most. Build a small number of clear policies around those needs.

Test policies with appropriate users before applying them broadly. Keep emergency administrative access considerations in mind, and document why each policy exists.

It also helps to review policies after major changes, such as introducing remote work, allowing contractors, deploying managed devices, or adding sensitive applications.

Franklin Web Technologies can support this type of review by helping businesses connect access controls to actual operational requirements instead of adding rules without a clear purpose.

Do You Need MFA and Conditional Access Together?

For many businesses, the strongest setup is not MFA or Conditional Access. It is MFA with Conditional Access.

A Conditional Access policy can require MFA only when a particular condition exists. For example, an organization could require MFA for a specific application, apply stronger requirements to administrators, or respond to a higher-risk sign-in.

This layered model allows the business to keep MFA as a baseline while using Conditional Access for more precise decisions.

The right configuration depends on the organization’s Microsoft 365 licensing, applications, users, device management, and access requirements. Some Conditional Access and risk-based capabilities require specific Microsoft Entra licensing, so licensing should be checked before planning the final policy set.

Common Mistakes Small Businesses Should Avoid

The biggest mistake is treating MFA as a complete answer to every access problem. MFA improves identity verification, but it does not replace access policies.

Another mistake is creating Conditional Access rules without first documenting the business requirement behind each one. A policy should have a clear purpose, such as requiring MFA for administrators or restricting access from unmanaged devices.

Businesses should also avoid changing multiple policies at once without testing. A single poorly configured rule can affect many users.

Finally, do not overlook administrator accounts. A small number of highly privileged accounts can have a much greater impact than ordinary user accounts, so they deserve careful access controls and monitoring.

Frequently Asked Questions

Is MFA better than Conditional Access?

Neither control is a direct replacement for the other. MFA verifies identity using an additional factor, while Conditional Access determines access based on configured conditions. Most businesses should consider MFA a baseline and add Conditional Access when they need more precise rules.

Can Conditional Access require MFA?

Yes. Conditional Access policies can require MFA as a condition for accessing selected Microsoft resources or under specified sign-in circumstances. This is one reason the two controls often work together.

Does Conditional Access replace MFA?

No. Conditional Access can use MFA as one of its requirements, but it does not replace the authentication method itself. A business can use Conditional Access to determine when MFA should be required.

Is Conditional Access necessary for a small business?

Not every small business needs a complex Conditional Access setup. A small company with straightforward access requirements may begin with MFA. Conditional Access becomes more useful as the organization needs device, location, application, user, or risk-based access rules.

What is the difference between MFA and identity access management?

MFA is one type of identity and access control focused on verifying users through multiple factors. Identity access management is a broader discipline covering how users are identified, authenticated, authorized, and managed across systems and resources.

Can MFA prevent account takeover?

MFA can significantly reduce the usefulness of a stolen password because an attacker may still need the additional authentication factor. It should be combined with appropriate account, device, and access controls for stronger protection.

Choose the Control That Matches the Business Need

MFA and Conditional Access should not be viewed as competing products. They address different parts of the login and access process. MFA confirms more strongly that the person signing in is the legitimate account holder. Conditional Access determines what should happen based on the circumstances of that sign-in.

For a small business starting with basic Microsoft 365 protection, MFA is usually the first practical step. Businesses with remote workers, contractors, managed devices, sensitive applications, or more complex access requirements can add Conditional Access to create more specific rules.

A focused policy set is usually more useful than a large collection of rules that nobody fully understands. Review the business’s users, devices, applications, and access patterns first, then build controls around those real requirements. If you need help assessing your Microsoft 365 environment or planning an access policy structure, contact us for guidance on choosing an approach that fits your organization.

Read more at Franklin Web Technologies

What Is Conditional Access? A Small Business Guide to Microsoft 365 Login Security

analytics11 — Wed, 26 Aug 2026 18:00:00 +0000

A stolen password should not automatically give someone access to Microsoft 365. What is Conditional Access is a question about how Microsoft can evaluate the circumstances around a sign-in and apply additional access requirements before allowing entry. Microsoft Conditional Access uses signals such as the user, device, location, application, and sign-in risk to determine what access should be allowed.

For a small business, this can mean requiring MFA for administrators, blocking access from untrusted locations, requiring managed devices for sensitive resources, or responding differently to risky sign-ins. Franklin Web Technologies helps businesses understand and configure these Microsoft 365 login security controls around their actual working environment.

What Is Conditional Access in Microsoft 365?

Conditional Access is a policy-based access control feature in Microsoft Entra ID. It works through an “if-then” model: if specific conditions are present during a sign-in, then Microsoft applies a defined access requirement.

For example, a business could create a policy that says: if an employee signs in to Microsoft 365 from an unfamiliar device, require MFA before granting access. Another policy could require a company-managed device before someone can access sensitive business information.

Microsoft describes Conditional Access as its Zero Trust policy engine because it uses multiple signals to make access decisions instead of treating every successful password authentication as sufficient.

The policies can grant access, require additional controls, or block access altogether. Administrators can also apply session controls that influence how a user remains signed in or interacts with selected cloud applications.

Why Does Conditional Access Matter for Small Businesses?

Many small businesses start with a basic combination of usernames, passwords, and MFA. MFA is an essential layer, but it does not answer every access question.

A valid username and password can still be used from an unmanaged computer. A compromised account can still be accessed from an unusual location. An administrator might sign in from a device that does not meet the organization’s requirements.

Conditional Access adds context to the login decision.

Instead of asking only, “Did this person provide the correct credentials?” an access policy can consider questions such as:

Who is signing in?

What application or resource are they trying to access?

What device are they using?

Where is the sign-in coming from?

Is the sign-in showing elevated risk?

What additional authentication or device requirement should apply?

This approach supports identity security by making access decisions based on the circumstances surrounding each request.

How Do Conditional Access Policies Work?

Conditional Access policies contain assignments and access controls. Assignments establish the circumstances under which a policy applies, while access controls determine what happens when those circumstances are met.

An administrator can target specific users or groups, applications, device platforms, locations, and other conditions. The policy can then require MFA, require a compliant device, block access, or apply another supported control.

For example:

Condition: An employee accesses Microsoft 365 from an unmanaged device.

Action: Require MFA and a compliant device before granting access.

Several Conditional Access policies can apply to the same sign-in. Microsoft evaluates the applicable requirements, so a user may need to satisfy more than one condition before access is granted.

This is useful for businesses that need different rules for administrators, office staff, contractors, remote workers, and users accessing sensitive applications.

Conditional Access vs MFA: What Is the Difference?

The distinction in MFA vs Conditional Access is straightforward.

MFA verifies that the person signing in can provide an additional authentication factor. Conditional Access determines when that additional requirement, or another access control, should be applied.

MFA can be viewed as an authentication method. Conditional Access is the policy layer that decides how and when access requirements are enforced.

For example, a company could require MFA for every user. It could then use Conditional Access to add another rule requiring administrators to use MFA when accessing administrative resources or requiring a compliant device for sensitive applications.

Microsoft’s Conditional Access grant controls include requirements such as MFA, authentication strength, device compliance, an approved client application, an app protection policy, or a password change. Administrators can also choose to block access.

That makes Conditional Access broader than simply turning on MFA.

Practical Conditional Access Policies for a Small Business

A small business does not need dozens of complicated access policies to establish a stronger baseline. The useful starting point is a small set of policies that address common access risks.

Require MFA for Administrators

Administrator accounts can change settings, manage users, and control business resources. Requiring MFA for these accounts creates an additional verification step before privileged access is granted.

Microsoft lists requiring MFA for administrators among its common Conditional Access policies.

For organizations with stronger authentication requirements, authentication strength policies can also be used to define the type of authentication required.

Block Legacy Authentication

Older authentication protocols may not support modern authentication requirements. Blocking legacy authentication prevents users from accessing Microsoft 365 through methods that cannot properly satisfy modern controls.

Microsoft identifies blocking legacy authentication as a common Conditional Access policy and includes it in its recommended policy templates.

This is especially useful during Microsoft 365 hardening because a business can remove an older access path instead of relying only on passwords and MFA.

Require Managed or Compliant Devices

A password and MFA do not tell an organization if the device being used is managed or meets its device requirements.

Conditional Access can require a device to be marked compliant before granting access. This can be useful for employees accessing sensitive Microsoft 365 resources from company-managed computers.

The exact device requirement depends on how the organization manages its endpoints and which Microsoft services and licenses it uses.

Respond to Risky Sign-Ins

Microsoft Entra ID can provide risk signals that Conditional Access policies use to respond to suspicious authentication activity. For organizations with the required licensing, risk-based policies can require MFA for elevated sign-in risk or take other corrective action.

This creates a more responsive access policy. A familiar sign-in may follow the normal authentication process, while a sign-in presenting elevated risk can trigger an additional requirement.

Can Conditional Access Block Access?

Yes. Conditional Access can block access when a defined condition is met.

For example, an organization could create a policy that blocks access from selected locations. Microsoft supports location-based policies that can use network location information to control access to cloud applications.

Blocking access requires careful testing because an overly broad policy can prevent legitimate users from reaching Microsoft 365. Microsoft recommends using report-only mode and testing policy impact before enabling restrictive policies.

Businesses should also maintain emergency access accounts that are excluded appropriately from policies to reduce the chance of administrators being locked out after a configuration mistake.

Conditional Access and Zero Trust

Zero Trust is based on verifying access rather than assuming that a user should be trusted simply because they have valid credentials or are connecting from a familiar network.

Conditional Access supports this model by evaluating identity, device, application, location, and risk signals before enforcing access requirements.

For a small business, Zero Trust does not mean creating an enormous collection of complicated rules. It can begin with practical decisions such as requiring MFA for privileged accounts, blocking legacy authentication, restricting access from unmanaged devices where appropriate, and responding to high-risk sign-ins.

The objective is to make access decisions based on evidence rather than treating every successful password login the same way.

How Should a Small Business Start?

Conditional Access should be introduced carefully. A policy that looks reasonable on paper can behave differently once it encounters real users, devices, applications, and sign-in patterns.

Start by identifying the accounts and resources that require the strongest protection. Administrators should usually receive stricter controls than ordinary users because they have broader permissions.

Next, review the devices employees use to access Microsoft 365. If the company manages its devices through Microsoft Intune, device compliance can become part of access decisions.

Then review sign-in locations and authentication methods. Unusual locations, older authentication protocols, and elevated sign-in risk can provide useful signals for additional controls.

Before activating restrictive policies, use report-only mode and test them with designated users. Microsoft specifically recommends maintaining a test user and validating policies before deployment.

A practical rollout can follow this order:

Protect administrator accounts with MFA and stronger authentication requirements.

Block legacy authentication and review sign-in activity.

Apply device and application requirements to sensitive resources.

Add risk-based policies where the required Microsoft Entra licensing is available.

Review policies regularly as users, devices, applications, and business requirements change.

This approach keeps the initial configuration manageable while creating room for more specific access policies later.

Common Conditional Access Mistakes to Avoid

The biggest problems often come from policy design rather than the feature itself.

One common mistake is creating broad block policies without testing them. A rule that blocks an entire location, user group, or application can affect legitimate business activity.

Another issue is applying too many policies at once. Multiple policies can affect the same sign-in, so administrators need to understand how assignments overlap and which requirements users must satisfy.

Excluding emergency access accounts is also an important safeguard. These accounts provide a recovery path if a configuration error prevents normal administrative access.

Businesses should also avoid treating Conditional Access as a replacement for every other Microsoft 365 security control. Strong authentication, appropriate account privileges, device management, secure configuration, monitoring, and regular reviews all contribute to a safer environment.

What Does Conditional Access Mean for Your Business?

For an SMB, Conditional Access is essentially a set of rules that determines when a Microsoft 365 login should be allowed, challenged, restricted, or blocked.

Its value comes from adding context to authentication. A user with valid credentials may receive different access requirements depending on the device, application, location, identity, and risk associated with the sign-in.

That makes Conditional Access a practical part of Microsoft 365 login security and identity security. Instead of applying the same login rule to every situation, businesses can create access policies that reflect the sensitivity of their resources and the circumstances of each sign-in.

Franklin Web Technologies can help businesses review their Microsoft 365 configuration, identify gaps in Conditional Access policies, and prioritize controls that fit their users and working environment.

Build a More Controlled Microsoft 365 Login Environment

Conditional Access gives small businesses a practical way to move beyond password-based access decisions. The most useful policies are not necessarily the most complicated ones. Strong administrator protection, modern authentication, sensible device requirements, legacy authentication blocking, and risk-based controls can establish a solid foundation.

The right configuration also requires testing and ongoing review. Microsoft recommends validating policies before enforcement because poorly designed rules can interrupt legitimate access.

For businesses that want a clearer assessment of their Microsoft 365 access policies, Request a Security Consultation to review your current configuration and identify practical improvements.

Read more at Franklin Web Technologies

Microsoft 365 Security Checklist: 15 Settings Every Small Business Should Review

analytics11 — Wed, 26 Aug 2026 06:17:57 +0000

A secure Microsoft 365 tenant depends on more than turning on multifactor authentication. Small businesses also need to review administrator privileges, legacy authentication, external forwarding, application permissions, audit logging, email protection, and sharing controls. This Microsoft 365 security checklist highlights 15 settings that are easy to overlook but can have a direct effect on account compromise, data exposure, and business continuity. Franklin Web Technologies uses this type of configuration-focused review to help businesses identify gaps that basic security setup can leave behind.

1. Confirm that MFA protects every user

Multifactor authentication should cover regular users, administrators, contractors, and other accounts that can access business data. A password alone provides limited protection against phishing, password spraying, and reused credentials.

Businesses without Microsoft Entra ID P1 or P2 can use Security Defaults as a baseline. Security Defaults require MFA registration and block several older authentication methods. Organizations with Microsoft Entra ID P1 or higher can use Conditional Access for more granular policies.

Example configuration:

Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults

Do not assume MFA is active simply because some employees receive authentication prompts. Check the tenant configuration and sign-in reports to verify coverage.

2. Review the authentication methods employees can register

MFA is only as strong as the authentication methods behind it. Microsoft 365 administrators should review which methods users can register and remove methods that do not fit the organization’s security requirements.

For privileged users, phishing-resistant methods such as passkeys or FIDO2 security keys provide stronger protection against phishing than methods that depend entirely on passwords or approval prompts.

A useful Microsoft 365 security assessment should identify users with weak, outdated, or unnecessary authentication methods and verify that recovery options are also controlled.

3. Protect administrator accounts separately

A Global Administrator account should not be the same account used for routine email, Teams conversations, web browsing, and document work.

Create dedicated administrator accounts and assign only the roles required for administrative duties. Microsoft recommends least-privileged administrative roles as part of identity security guidance.

Review the following:

Global Administrator assignments

Exchange Administrator assignments

Security Administrator assignments

Privileged Role Administrator assignments

Inactive administrator accounts

This is a central part of Microsoft 365 admin security because a compromised administrator account can affect far more than one employee’s mailbox.

4. Create and test emergency access accounts

An emergency access account is designed for situations such as an administrator lockout or authentication-policy failure. It should not become someone’s everyday account.

Microsoft recommends maintaining at least two cloud-only emergency access accounts, protecting them with phishing-resistant authentication, storing credentials securely, monitoring their use, and validating them regularly.

Example:

Create two dedicated .onmicrosoft.com accounts, document their purpose, secure their credentials separately, and test access at least every 90 days.

These accounts should be treated as controlled recovery mechanisms, not spare administrator accounts.

5. Block legacy authentication

Legacy authentication is one of the settings that deserves immediate attention during Microsoft 365 hardening.

Older protocols such as POP3, IMAP, and other basic authentication methods do not support modern security controls such as MFA. Microsoft specifically recommends blocking legacy authentication because attackers can use these protocols to bypass protections applied to modern sign-ins.

Check sign-in logs before enforcing the policy. Identify devices, applications, scanners, or other services still relying on older authentication and migrate them first.

6. Review device code authentication

Device code authentication can be useful for devices with limited input capabilities, but it can also be abused in phishing attacks. Microsoft Security Defaults block device code flow as part of their baseline protections.

Organizations using Conditional Access should review policies covering device code authentication and determine if any legitimate business process requires an exception.

An overlooked authentication flow can give an attacker another route into a tenant even after conventional MFA controls are enabled.

7. Limit unnecessary application consent

Employees can sometimes grant applications access to Microsoft 365 data. An employee may approve an application without realizing that the permission allows access to mail, files, calendars, contacts, or other organizational information.

Review Microsoft Entra application consent settings and decide who can approve applications. For higher-risk permissions, route requests through administrator approval.

Example policy approach:

Require administrator approval for applications requesting sensitive Microsoft Graph permissions.

This reduces the chance that a malicious or poorly configured third-party application becomes an indirect path to business data.

8. Review inactive users and guest accounts

Old employee accounts, dormant users, former contractors, and unused guest accounts increase the number of identities that need protection.

Run regular reviews of:

Disabled and inactive accounts

Guest users

Users with administrative roles

Accounts that have not signed in for extended periods

Microsoft’s identity security recommendations specifically include removing dormant accounts from sensitive groups and using least-privileged administrative roles.

Account cleanup should be part of normal Microsoft 365 administration rather than an occasional security project.

9. Check external email forwarding

Automatic forwarding deserves special attention because it can quietly move company information outside the tenant.

Microsoft identifies automatic forwarding to external recipients as a security concern because it can expose organizational information. Users can create forwarding through inbox rules, while administrators can configure mailbox forwarding.

Review existing forwarding rules and determine which external destinations are legitimate.

Example check:

Exchange admin center > Mail flow > Remote domains / outbound spam policies

For most small businesses, external automatic forwarding should be restricted unless there is a documented business requirement.

10. Tighten external sharing in SharePoint and OneDrive

SharePoint and OneDrive can contain contracts, financial documents, customer information, employee records, and internal procedures. A permissive sharing configuration can make sensitive files accessible outside the organization.

Review default sharing links, guest access, anonymous links, and domain restrictions. Apply stricter controls to sites containing confidential information.

A useful configuration principle is simple: users should have an easy internal sharing process while external access requires a clear business reason.

11. Turn on the right email protection policies

Microsoft Defender for Office 365 provides controls such as Safe Links, Safe Attachments, and enhanced anti-phishing protection. Microsoft notes that the built-in protection preset provides basic Safe Links and Safe Attachments protection for eligible Defender customers, while Standard and Strict preset policies provide stronger configurations.

Review:

Anti-phishing policies

Impersonation protection

Safe Links

Safe Attachments

Anti-malware policies

Pay particular attention to executive accounts, finance users, and employees who frequently handle payment or customer information.

12. Protect against impersonation attacks

A basic spam filter does not address every impersonation scenario. Attackers may imitate executives, suppliers, domains, or trusted contacts to convince employees to transfer money or disclose information.

Microsoft Defender for Office 365 supports impersonation protection through its security policies. The default anti-phishing policy includes spoof protection and mailbox intelligence, while additional impersonation controls require configuration through preset or custom policies.

Add high-value users and important business domains to the appropriate protection policies and review alerts regularly.

13. Verify that audit logging is useful

Audit logs are valuable only when the organization knows what activity it needs to investigate.

Confirm that auditing is available and that administrators know where to review activity involving users, administrators, mailboxes, applications, and other Microsoft 365 services.

A security review should also establish a basic retention and investigation process. Suspicious sign-ins, unexpected permission changes, forwarding rules, and administrator actions should have a clear path for investigation.

For emergency access accounts, Microsoft specifically recommends monitoring sign-in and audit logs.

14. Review Microsoft Secure Score instead of ignoring it

Microsoft Secure Score provides a useful starting point for identifying security improvements. The identity portion evaluates configuration against recommended controls and recalculates based on the tenant’s security posture.

Do not treat the score as a complete security rating. A high score does not prove that every important business risk has been addressed.

Use it as a review queue. Prioritize recommendations based on the sensitivity of your data, user roles, current threats, licensing, and operational requirements.

15. Review Conditional Access policies for gaps and exceptions

Conditional Access can apply rules based on factors such as user, application, device, location, and authentication requirements. The danger is not only missing policies. Poorly managed exclusions can create the same problem.

Review every policy for:

Users or groups excluded from MFA

Emergency access exclusions

Legacy authentication blocks

Administrator protection

Unmanaged device access

Report-only policies that were never enforced

Microsoft recommends using Conditional Access when organizations need more customization than Security Defaults provides.

Document every exception and assign an owner. An exception without an owner can remain in place long after the original business need has disappeared.

How To Turn The Checklist Into A Practical Security Review

A useful Microsoft 365 security assessment should not stop at checking boxes. Record the current configuration, identify the business reason for exceptions, assign a responsible administrator, and set a review date.

For example, a small business might find that MFA is enabled for employees but three administrator accounts are excluded from a Conditional Access policy. Another review might uncover external forwarding from an old mailbox or guest accounts that have not been used for months.

Those findings have different levels of urgency, so prioritize them by business impact. An administrator account without strong authentication generally deserves faster remediation than a low-risk configuration preference.

Franklin Web Technologies can use this configuration-first approach to help businesses examine Microsoft 365 security settings beyond the obvious controls. The goal is to identify settings that attackers could exploit and translate technical findings into practical actions for the business.

A Simple Review Schedule For Small Businesses

Security settings should be reviewed after major Microsoft 365 changes, administrator changes, new applications, acquisitions, employee departures, and significant changes to how staff access company data.

A quarterly review can cover administrator roles, inactive users, guest accounts, authentication methods, forwarding rules, Conditional Access exclusions, external sharing, and Defender policies. A deeper annual review can examine the complete tenant configuration and compare it against current Microsoft 365 security best practices.

The process also gives business owners a clearer picture of their Microsoft 365 security risks instead of relying on assumptions about default protection.

Final Thoughts

Microsoft 365 can provide strong built-in security, but secure configuration still requires attention. MFA, administrator protection, legacy authentication controls, forwarding restrictions, application consent, email defenses, sharing policies, and audit visibility all contribute to a safer tenant.

The most effective checklist is one that reflects how your business actually uses Microsoft 365. Review the settings, document exceptions, remove unnecessary access, and test recovery controls instead of assuming they work.

For small businesses that need a more detailed review or assistance with secure Microsoft 365 for small business, Contact Us Now to discuss your Microsoft 365 configuration and identify practical security improvements.

Read more at Franklin Web Technologies

Plugging the Holes: Protect Your Business with Defender

Martin Franklin — Thu, 08 Jan 2026 15:52:55 +0000

Small businesses are prime targets. Cybercriminals know many small businesses don’t have dedicated IT teams. A single click can lead to data breaches, ransomware, and financial loss.

Let’s break down the three biggest threats and how Microsoft Defender for Office 365 helps you stop them.

Phishing Emails – The Silent Trap

Story:
You’re managing invoices when an email arrives from what looks like your bank. It says there’s an urgent issue and asks you to click a link. You click, enter your details—and attackers now have your credentials.

Why It Matters:
Phishing emails trick you into giving away passwords or sensitive info. They look legitimate and urgent.

Defender’s Protection:

Malware – The Hidden Enemy

Scenario:
An invoice attachment from a “vendor” arrives. One click, and malware installs on your system, stealing data or locking files for ransom.

Why It Matters:
Malware can cripple your business overnight.

Defender’s Protection:

Malicious URLs – The Click That Costs You

Scenario:
Links in emails or chats lead to fake websites that capture your login details or install spyware.

Why It Matters:
Malicious URL attacks often bypass basic spam filters.

Defender’s Protection:

Don’t wait until an attack happens. Let’s make your business resilient today.

Read more at Franklin Web Technologies