Microsoft 365 for SMBs: the settings to check before an incident happens

The priorities to check before an emergency hits

Here are the checks we recommend making rather than waiting for an incident. The goal isn’t to turn your business into a cybersecurity department. It’s to reduce the most common risks with simple decisions that are documented and easy to maintain.

Start with the administrator accounts

The first thing to check is often the least visible: who has administrator rights in Microsoft 365. In many small businesses, that access was handed out quickly during a migration, then forgotten. An admin account used every day to read email or browse the web adds risk for no good reason.

In practice, it’s better to limit administrator accounts, keep management accounts separate from everyday work accounts, and keep at least one documented emergency access account. You should also confirm that former providers, former employees and temporary accounts no longer have elevated permissions.

Turn on MFA where the risk is real

MFA, or multi-factor authentication, is one of the most important Microsoft 365 settings for Québec SMBs. It adds a verification step when an account signs in, especially from a new device or an unusual location.

The trap is turning it on without supporting your users. People end up with notifications they don’t understand, phones that aren’t set up properly or service accounts that stop working. A clean rollout plans for communication with employees, recovery methods, priority accounts and justified exceptions.

Microsoft also publishes documentation on multi-factor authentication that can be a good starting point to understand the available options.

Review Exchange Online and shared mailboxes

Exchange Online makes email easier to manage, but some settings deserve a regular review. External forwarding, inbox rules, shared mailboxes and aliases can become blind spots. A fraudulent rule that moves invoices or forwards messages outside the company can go unnoticed for a long time.

For reasonable small business email security, check forwarding rules, delegated access, the shared mailboxes still in use and any accounts that weren’t disabled after someone left. These are simple checks, but they prevent a lot of confusion when a problem comes up.

Don’t confuse Microsoft 365 with a complete backup

Microsoft 365 offers retention and several protection mechanisms, but that doesn’t automatically replace a backup strategy suited to your business. If a user deletes documents, if an account is compromised or if a mistake goes unnoticed for too long, recovery can be more complicated than expected.

The right question isn’t just “do we have a backup?” You also need to ask: who can restore, how quickly, back to what date, and has a restore test ever been done? A backup that has never been tested is still just an assumption.

Consider the devices your team uses

Tenant settings aren’t enough if devices are neglected. A family laptop, a phone with no passcode or a computer that no longer gets updates can expose the same email as an office workstation. A small business doesn’t need heavy controls to get started: at a minimum, you need to know which devices connect, what to do when a phone is lost and how to sign out active sessions when needed.

Have a procedure for employee departures

An employee departure should trigger a short procedure, not a series of improvised decisions. Disabling the account, changing shared access, transferring or archiving the mailbox, getting devices back, ending active sessions: every step counts.

The key is to decide in advance what must be kept, what must be cut off and who approves access to the old emails. This procedure protects the business as much as the person in charge of operations.