Direct Answer Summary
Microsoft 365 provides enterprise-grade cloud productivity, but its default out-of-the-box configuration prioritises ease-of-use over security. Australian SMEs face credential stuffing, business email compromise, and session hijacking when default settings are left unmanaged. Hardening Microsoft 365 requires enabling Conditional Access, enforcing phishing-resistant MFA, disabling legacy protocols, restricting external sharing, and deploying dedicated third-party immutable backup.
Table of Contents
- › The Default Microsoft 365 Security Problem
- › Microsoft 365 Licensing: Standard vs Business Premium
- › Why Conditional Access Is Crucial for Hybrid Teams
- › Securing Administrative & Break-Glass Accounts
- › Defending Exchange Online Against Phishing & BEC
- › Clean Employee Offboarding Protocols
- › Why Microsoft 365 Requires Third-Party Backup
The Default Microsoft 365 Security Problem
Microsoft 365 powers thousands of Melbourne businesses, yet many operate with default tenant configurations. Out-of-the-box settings are intentionally configured for minimal user friction, not defense-in-depth. In default tenants, we routinely discover:
- Legacy Authentication Protocols Enabled: Outdated email protocols (IMAP, POP3, SMTP) bypass modern Multi-Factor Authentication prompts entirely, leaving mailboxes vulnerable to password spraying.
- Unrestricted External Sharing: SharePoint and OneDrive allow users to generate anonymous, public links to internal folders with no expiration dates.
- Disabled Audit Logging Retention: Free or standard tenants historically provided limited audit log retention, severely hampering forensic investigations following a data breach.
- Global Admin Accounts Used for Daily Email: Key directors operate with permanent Global Administrator privileges while reading daily phishing-prone email in Outlook.
Licensing: Business Basic vs Business Standard vs Business Premium
A common misconception among business owners is that all Microsoft 365 plans include the same security tools. The security capability gap between plans is substantial:
| Plan | Productivity Tools | Security & Device Management Capabilities |
|---|---|---|
| Business Basic | Web and mobile apps only (Teams, Exchange, SharePoint). | Basic Security Defaults only; no Conditional Access; no Intune MDM. |
| Business Standard | Full desktop apps (Word, Excel, Outlook, PowerPoint) + cloud services. | Same basic security as Business Basic. No advanced threat defense included. |
| Business Premium | Full desktop apps + complete cloud collaboration suite. | Microsoft Entra ID P1 (Conditional Access), Microsoft Intune (MDM/MAM), Microsoft Defender for Business (EDR). |
For Australian businesses with 10 to 75 users, Microsoft 365 Business Premium represents the most cost-effective security investment, eliminating the need to purchase separate third-party antivirus, device management, and identity software.
Why Conditional Access Is Crucial for Hybrid Teams
Standard MFA prompts for a code, but does not examine the context of the login. Conditional Access acts as an intelligent gatekeeper, evaluating signals before granting access to company files:
- Geofencing: Block authentication attempts originating from countries where your firm has no staff or clients.
- Device Compliance: Ensure only company-managed laptops with active BitLocker encryption and current antivirus can sync SharePoint matter files.
- Legacy Protocol Blocking: Block older email clients that fail to support modern authentication prompts.
Securing Administrative & Break-Glass Accounts
Adversaries specifically target Global Administrator accounts. SouthCore applies three strict rules to tenant administrative governance:
- Dedicated Cloud-Only Admin Accounts: Admins must never use their personal email account for tenant administration. They must use a separate account (e.g.
admin-jcitizen@domain.onmicrosoft.com) with no assigned mailbox. - Phishing-Resistant MFA: Hardware security keys (FIDO2) or Microsoft Authenticator number-matching must be enforced on all administrative roles.
- Documented Emergency Break-Glass Account: At least two break-glass accounts with strong, monitored credentials should exist to prevent tenant lockout during an outage.
Defending Exchange Online Against Phishing & BEC
Email is the primary entry point for cyber threats targeting Australian small businesses. Securing Exchange Online requires three non-negotiable DNS authentication layers:
- SPF (Sender Policy Framework): Designates which mail servers are authorized to send email on your domain’s behalf.
- DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outbound messages, proving they were not altered in transit.
- DMARC (Domain-based Message Authentication): Instructs recipient servers to reject fraudulent spoofed emails claiming to originate from your domain.
Clean Employee Offboarding Protocols
When staff leave a business, lingering account access creates severe data leakage risks. A secure offboarding procedure must:
- Instantly revoke active sessions and block user sign-in via Microsoft Entra ID.
- Convert the user’s mailbox to a shared mailbox to retain historical client correspondence without incurring unnecessary ongoing license fees.
- Wipe corporate data from the departing employee’s mobile devices via Microsoft Intune.
- Reassign OneDrive document permissions to the employee’s line manager.
Why Microsoft 365 Requires Third-Party Backup
Under the Microsoft Shared Responsibility Model, Microsoft operates the cloud platform, while your organisation must understand its own retention, backup and recovery needs. The appropriate protections depend on configuration and service terms.
Microsoft 365 native recycle bins retain deleted SharePoint files for a limited window (typically 93 days). Furthermore, if ransomware encrypts your local files, synced cloud versions can become corrupted simultaneously. Deploying dedicated, immutable third-party backup ensures point-in-time recovery across Exchange, SharePoint, OneDrive, and Teams.