Hardening Microsoft 365: 12 Settings for Swiss SMEs

Most takeovers of Microsoft 365 accounts need no zero-day. They need a password from a leak, a protocol without MFA or a forwarding rule nobody notices. The good news: the settings that prevent this are known, mostly included in the Business Premium subscription and set in an afternoon. Here are the twelve I would implement first.

In short: Hardening Microsoft 365 means above all protecting identities (MFA for everyone, no legacy protocols, few admins), securing mail (no external forwarding, DMARC, attachment and link scanning), limiting sharing and switching on logs. Twelve settings cover the majority of the attacks that actually occur in Swiss SMEs.

What you need before you start

• Licence: Microsoft 365 Business Premium (or E3) brings Entra ID P1 for Conditional Access, Defender for Office 365 P1 for Safe Links and Safe Attachments, plus Intune. With Business Standard only the basic protection via Security Defaults remains — even that is better than nothing.
• A test window: Conditional Access rules can be rolled out in report-only mode. Observe first, then enforce — that way you do not lock yourself out.
• The break-glass accounts (point 4) before the first enforced rule. That is the one order that is not negotiable.
• Communication. Most queries after a hardening are not technical: “Why is my phone suddenly asking for a code?” A short email to everyone before the cut-off date, with instructions and a contact person, saves more time than any setting.

Identity: the first four

1. MFA for all users via Conditional Access

Not as a per-user setting, but as a rule: all users, all cloud apps, grant access only with multi-factor. Microsoft itself has put a figure on it for years: MFA stops over 99 percent of automated account attacks. Exceptions only for the break-glass accounts. Path: Entra admin center → Protection → Conditional Access → New policy. Pitfall: service accounts that “cannot do MFA” — those belong on certificates or managed identities, not on the exception list.

2. Phishing-resistant MFA for admins

An SMS or a push notification can be intercepted with a proxy phishing kit; a FIDO2 key or a passkey cannot. For all accounts with admin roles, enforce a rule with authentication strength: phishing-resistant MFA. Cost: two hardware keys per admin, around 30 to 60 francs each.

3. Block legacy authentication

IMAP, POP, SMTP auth and old Office clients bypass MFA completely. A Conditional Access rule with the condition client apps: Exchange ActiveSync and other clients → Block. First check the sign-in logs for who still signs in this way: usually a multifunction printer or a scanner that can be switched to SMTP relay or to modern auth.

4. Two break-glass accounts

Two cloud-only accounts with the Global Admin role, long random passphrases (in the safe, not in IT’s password manager), excluded from all Conditional Access rules and with an alert rule on every sign-in. They are never used day to day — they are the key under the doormat for the day a rule locks everything out.

Access and rights: five to seven

5. Global admins to a minimum

Two to four people, each with a separate admin account without a mailbox and without a licence for Office apps. All other tasks via the specific roles (Exchange Administrator, User Administrator). With Entra ID P2 additionally Privileged Identity Management: rights only for a limited time, with justification. Without P2 at least a quarterly look at the role list.

6. Restrict user app consent

By default every user may grant any app access to mail and files — OAuth phishing then needs no password. Entra admin center → Enterprise applications → Consent and permissions: user consent only for verified publishers and low-impact permissions, everything else via the admin consent workflow.

7. Limit external sharing and guests

SharePoint admin center → Policies → Sharing: for the organisation New and existing guests instead of Anyone; anonymous links only if there is a reason, then with an expiry date. Review guest accounts in Entra ID at least annually — automated via Access Review with P2, otherwise by list.

Email: eight to ten

8. Block automatic forwarding to external addresses

After an account takeover, a silent forward to an external address is the most common way to read along. Exchange admin center → Protection → Outbound spam policy → Automatic forwarding: Off. Whoever needs an exception gets it by name.

9. SPF, DKIM and DMARC for every one of your domains

SPF says who may send on behalf of the domain, DKIM signs, DMARC tells recipients what should happen with forgeries. Start with p=none and read the reports, then move to p=quarantine and finally p=reject. Without DMARC your own domain can be used for CEO fraud against your own customers.

10. Switch on preset security policies

Defender portal → Email & collaboration → Policies → Preset security policies: Standard for everyone, Strict for management and finance. This activates Safe Links, Safe Attachments and impersonation protection in one step — including the names of the executive board as protected senders.

Visibility: eleven and twelve

11. Switch on the audit log and know the retention

Microsoft Purview → Audit: the unified audit log must be active, otherwise there is nothing to investigate after an incident. The default retention is around half a year depending on the licence; whoever needs longer exports regularly or uses a SIEM. Secure the sign-in logs from Entra ID as well — they are retained for a shorter time than you think.

12. Alerts for the three critical events

At least three alert rules that go by email to more than one person: a sign-in by a break-glass account, a new assignment of the Global Admin role and a newly created forwarding rule. With Entra ID P2 add the risk-based policies: block on high sign-in risk, password change on high user risk.

What the twelve do not cover

The list is deliberately limited to the tenant. Four topics belong in the next step:

• Devices. A valid token on an unpatched laptop is a problem no Conditional Access rule sees — unless it requires a compliant device. That needs Intune and a compliance policy, but is included in Business Premium.
• Endpoint protection. Defender for Business is part of the licence, but has to be rolled out and automated investigation switched on.
• Data. Purview sensitivity labels and DLP policies prevent sensitive files from leaving the house — sensible as soon as the identities are clean, not before.
• Backup. Microsoft protects the platform, not the content against deletion or encryption. A backup of Exchange, SharePoint and OneDrive is a separate decision — and one of the most important.

Teams guest access, Copilot permissions and the monitoring of third-party apps also deserve a look once the twelve points are in place.

The order that works

1. Create and test the break-glass accounts (4).
2. Check the audit log (11) so the next steps are documented.
3. Legacy auth and MFA in report-only mode (1, 3) — observe for a week, clean up exceptions, then enforce.
4. Admin roles and phishing-resistant MFA (2, 5).
5. Mail protection (8, 9, 10) — DMARC is a process of several weeks, start early.
6. Sharing, app consent, alerts (6, 7, 12).

All together, for an SME with 50 accounts this is an effort of two to three working days spread over a few weeks — the largest part is communication, not clicking. Whoever spreads the steps over two weeks rarely has more than an hour of work per day — and never a moment when the whole company is affected at the same time.

Afterwards: verify, do not believe

Whether the twelve points really take hold is shown not by a feeling but by a test. Maester checks exactly these settings automatically and can be run weekly — how an assessment is structured overall is in M365 Assessment: Where Tenants Are Really Vulnerable. The employees nevertheless remain the last line of defence: whether they recognise a fraud can be tried out with the phishing simulation. And how much budget remains for the rest beyond the licences is shown by the security budget check.