The Small Business Microsoft 365 Security Review: What to Check, in Plain English

Most Microsoft 365 security problems in a small firm are not exotic either. They are defaults nobody revisited: settings that let any member of staff create a group, register an application, approve a third-party app's access to the mailbox, or buy a subscription on the company's name.

This is the Microsoft 365 companion to our Google Workspace security review. Ten settings, about an hour, no jargon. For each one: what it is, why an attacker cares, where to look, what might break if you change it, and the license you need.

You need Global Administrator access to run it. Two of the ten are Conditional Access policies, which require Microsoft Entra ID P1. Microsoft states that Microsoft 365 Business Premium licenses include Conditional Access features. Everything else here works on any Microsoft 365 business plan.

As checked on October 14, 2026. Microsoft moves these menus, so every path below is the one Microsoft documented on that date, with the page linked. If a menu has moved by the time you read this, trust the setting name over the path.

1. Who can create Microsoft 365 groups

What it is. A Microsoft 365 group brings a mailbox, a SharePoint site and a Teams team with it. Creating one is not a small act.

Why an attacker cares. Groups create storage and a mailbox outside whatever you thought your perimeter was, and a compromised account can make them quietly. Sprawl also hides things: nobody notices one more team among two hundred.

Where to check. Microsoft Entra admin center, then Groups, then General. The setting is "Users can create Microsoft 365 groups in Azure portals, API or PowerShell" (Microsoft Learn).

The default. Microsoft's guidance on managing group creation states that by default all users can create Microsoft 365 groups, and that restricting creation to a chosen group of people needs Microsoft Entra ID P1 or P2 licenses for the people involved and is applied with PowerShell. That guidance now sits in Microsoft's archive, so treat the toggle in your own tenant as the authority rather than the documented default.

What might break. People who create teams for client matters will have to ask someone. In a five-person firm that is fine. In a fifty-person firm, decide who approves before you turn it off.

License. Reading the setting: any plan. Restricting creation to a named group: Entra ID P1 or P2.

2. Self-service sign-up, purchases and trials

What it is. Microsoft lets individual users buy or trial certain products on their own, attached to your tenant, with their own card.

Why an attacker cares. Less an attacker than an auditor: unmanaged subscriptions hold company data, outside your inventory and your offboarding checklist. When that person leaves, so does any record of what they bought.

Where to check. The Self-service trials and purchases page in the Microsoft 365 admin center, where each eligible product can be set to Allow, Allow for trials only, or Do not allow. The same control is available as the AllowSelfServicePurchase policy in the MSCommerce PowerShell module (Microsoft Learn).

The default. Microsoft states that "all new products are set to allow users to make a self-service purchase".

What might break. Someone who was quietly running the business on a self-bought tool will come and find you. That is the point of the exercise.

License. Any plan.

3. Who can create security groups

What it is. Security groups are what permissions and policies are assigned to. Who can make one matters more than it sounds.

Why an attacker cares. A compromised account that can create groups can create one, add itself, and wait for a policy to be assigned to it. It is also a way to make unexpected access look routine.

Where to check. Same page as item 1: Microsoft Entra admin center, Groups, then General, setting "Users can create security groups in Azure portals, API or PowerShell" (Microsoft Learn). Microsoft's note on turning it off: users can still manage groups they already own.

What might break. Very little in a small firm. If you use groups for distribution lists people manage themselves, check with them first.

License. Any plan.

4. Who can register applications

What it is. An application registration creates an identity in your tenant that software can sign in as.

Why an attacker cares. An app registration is an account that does not have a person, a phone or an MFA prompt attached to it. Attackers like them for exactly that reason, and a registration created today can still be there long after the person who made it has gone.

Where to check. Microsoft Entra admin center, then Entra ID, then Users, where the setting "Users can register applications" can be set to No. Microsoft's words: that "will disable the default ability for users to create application registrations", and you can grant it back to named people through the Application Developer role (Microsoft Learn).

The default. Microsoft's default user permissions page lists registering applications among the things member users can do out of the box.

What might break. Developers and anyone wiring up an integration will need the role. In a firm with no developers, nothing breaks.

License. Any plan.

5. Whether users can consent to third-party apps

What it is. When an app asks to read your mail or your files, someone has to approve it. This setting decides whether that someone is the staff member or you.

Why an attacker cares. This is consent phishing. Nobody's password changes hands. A convincing app asks for mailbox access, one person clicks Accept, and the attacker has a standing grant that survives a password reset.

Where to check. Microsoft Entra admin center: Identity, then Applications, then Enterprise apps, then Consent and permissions, then User consent settings (Microsoft Learn).

The default. Microsoft states that "by default, all users are allowed to consent to applications for permissions that don't require administrator consent". The tighter option Microsoft documents is "Allow user consent for apps from verified publishers, for selected permissions", which limits consent to verified publishers and to permissions you have classified as low impact.

What might break. Approval requests will start arriving. Decide who answers them and how fast, or people will route around you. Note Microsoft's warning that changing this affects future consent only: grants already given stay in place until you review them.

License. Any plan.

6. Device code sign-in

What it is. A sign-in method for devices that cannot show a sign-in page, where you type a short code elsewhere to complete the sign-in.

Why an attacker cares. It is phishable without a fake website. The victim types the attacker's code into Microsoft's real page, passes their own MFA, and the attacker's session receives the tokens. We wrote the full explanation in device code phishing on Microsoft 365.

Where to check. Microsoft Entra admin center, Entra ID, then Conditional Access, then Policies: a new policy with Conditions, then Authentication Flows, set to Device code flow, and Grant set to Block access. Microsoft's advice is to start in Report-only and to exclude break-glass accounts (Microsoft Learn). To see current use first, filter the sign-in logs on Authentication Protocol, value Device code.

What might break. A conference room display or a command-line tool that signs in this way. Report-only mode tells you before the block does.

License. Microsoft Entra ID P1, included with Microsoft 365 Business Premium.

7. Legacy authentication

What it is. Older mail protocols and clients that cannot do a modern sign-in, and therefore cannot do multifactor authentication.

Why an attacker cares. Microsoft's own analysis, quoted on its Conditional Access guidance, is that "more than 97 percent of credential stuffing attacks use legacy authentication and more than 99 percent of password spray attacks use legacy authentication protocols".

Where to check. A Conditional Access policy with Conditions, then Client apps, set to Yes, with Exchange ActiveSync clients and Other clients checked, and Grant set to Block access. Report-only first, again (Microsoft Learn).

What might break. An old scanner or copier that emails scans, a line-of-business app with a hardcoded mailbox, an ancient phone. This is the one where report-only earns its keep.

License. Microsoft Entra ID P1, included with Microsoft 365 Business Premium.

8. Automatic forwarding of email to outside addresses

What it is. A rule that sends a copy of incoming mail to an address outside your organization.

Why an attacker cares. It is the quiet half of business email compromise. The attacker reads everything for weeks without signing in again, waits for an invoice, and changes the bank details once.

Where to check. Microsoft Defender portal: Email & collaboration, then Policies & rules, then Threat policies, then Anti-spam, and open the outbound policy. The setting is "Automatic forwarding rules" (Microsoft Learn).

The default, carefully. The default value is Automatic - System-controlled. Microsoft explains that this value changed in 2021 to behave as Off for new organizations and for existing ones that were not actively using it, but can remain equivalent to On for organizations that were. Microsoft's own recommendation is to set On or Off explicitly rather than leave it on Automatic, which is good advice precisely because the default is ambiguous.

What might break. Anyone legitimately forwarding to a personal address, which is usually a conversation worth having anyway. Forwarding that is blocked produces a bounce message to the sender.

License. Any Microsoft 365 plan with Exchange Online.

9. How many people hold Global Administrator, and how they sign in

What it is. The role that can do anything, including undo everything else in this list.

Why an attacker cares. One compromised Global Administrator is the whole tenant. This is the account worth a week of an attacker's patience.

Where to check. Microsoft Entra admin center, under roles and administrators, and then the authentication methods those accounts actually use.

What good looks like. Microsoft recommends assigning the Global Administrator role "to fewer than five people in your organization", with all of those accounts protected by multifactor authentication (Microsoft Learn). Microsoft also publishes a Conditional Access policy for requiring phishing-resistant multifactor authentication for administrator roles, and lists Global Administrator first among the fourteen roles it names (Microsoft Learn).

What might break. Taking the role off someone who quietly used it for a weekly task. Ask first, then remove.

License. Counting admins and requiring MFA: any plan. Requiring phishing-resistant MFA through Conditional Access: Entra ID P1.

10. Whether the audit log is on

What it is. The record of who did what in your tenant: sign-ins, mailbox access, rule changes, file activity.

Why an attacker cares. They do not, until you need it. Without the log, an incident becomes a conversation about what probably happened, and your insurer and your clients get the same answer.

Where to check. Microsoft Purview portal, Audit solution card, which shows a banner prompting you to start recording if it is off. In Exchange Online PowerShell, Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled returns True when auditing is on (Microsoft Learn).

The default. Microsoft states that "audit logging is on by default for Microsoft 365 organizations", and still advises verifying it on a new tenant. Turning it on can take up to 60 minutes to take effect, and events are searchable a few hours later, so this is not a thing to check for the first time during an incident.

What might break. Nothing.

License. Any plan. Retention length varies by license, which is a separate conversation.

What the numbers say about doing this at all

Huntress, whose platform we operate, published figures on June 30, 2026 from more than 12,000 Microsoft 365 tenants in the Early Access program for its posture product: more than 60% of organizations were missing at least half of the recommended controls, 66% lacked recommended MFA configurations, 59% were missing key restrictions on admin accounts, and 55% had standard users who could perform administrative functions (Huntress).

Those are Huntress Early Access tenants, not a random sample of all businesses, and they are tenants that had already bought identity security. The point is not the precise percentage. It is that missing settings are the normal state, not the exception, and that nobody notices because nothing breaks when a setting is missing.

The one-hour version, recapped

1. Microsoft 365 group creation: restricted, or deliberately left open.
2. Self-service purchases and trials: set per product, not left at allow.
3. Security group creation: restricted unless you have a reason.
4. Application registrations: off for ordinary users.
5. Third-party app consent: verified publishers and low-impact permissions only.
6. Device code sign-in: blocked, after report-only.
7. Legacy authentication: blocked, after report-only.
8. Automatic external forwarding: set explicitly to On or Off, not Automatic.
9. Global Administrators: fewer than five, phishing-resistant MFA on all of them.
10. Audit log: verified on, today rather than during an incident.

Two honest ways to finish this

Do it yourself. Everything above is in the plan you already pay for, except the two Conditional Access policies, which need Entra ID P1. Work down the list, change what you can change today, and write down the two or three you decided not to touch and why. That written note is worth more at renewal time than a tidy score.

Have them applied and kept in place. Settings drift. Someone turns one off for a project in March and nobody turns it back on. Ridge Reserve includes Huntress Managed ISPM for Microsoft 365, which applies Microsoft 365 security settings and puts them back when they change, operated by Obsidian Ridge. The detail of how that rollout works is in the ISPM section of our Managed ITDR page.

On which of these ten settings that product covers: Huntress documents the framework as spanning multifactor authentication, administrative account policies, password policies, standard user permissions, guest permissions and Conditional Access policies, and at general availability extended beyond Entra ID to Exchange, SharePoint and Teams. Huntress does not publish a setting-by-setting list, so we are not going to map it item by item for you. Ask us and we will show you what is in the framework for your tenant.

If you want a second set of eyes on your own tenant first, that is what the free review is for. Running Google Workspace as well, or instead? The Google Workspace version of this review covers the same ground on that side.