Microsoft 365 Security Hardening Guide: 12 Critical Settings to Stop Invoice Fraud & BEC
Default Microsoft 365 tenant settings leave UK businesses vulnerable to Business Email Compromise (BEC). Here are the 12 Entra ID, Exchange, and SharePoint controls you must verify.
- Legacy authentication protocols (IMAP/POP/SMTP Basic Auth) must be blocked tenant-wide.
- Automatic external inbox forwarding rules are the #1 mechanism attackers use to hide inside finance mailboxes.
- Global Administrator accounts should be capped at 2–4 dedicated accounts protected by phishing-resistant MFA.
1. Why Microsoft 365 Is Your True Security Perimeter
For most UK accountancy practices, law firms, recruitment agencies, and SMEs, Microsoft 365 holds the entire business: client emails, BACS bank details, SharePoint contracts, and Teams messages. When an attacker compromises a single M365 login, they rarely deploy noisy malware immediately—instead, they create a silent inbox rule that forwards emails containing words like 'invoice', 'payment', or 'completion' to an external address.
2. The 12 Essential Microsoft 365 Hardening Controls
Audit these configuration controls across Microsoft Entra ID, Exchange Online, and SharePoint Admin Centres:
Official UK & International Standards Referenced
Audit your domain and Microsoft 365 perimeter automatically
Start with a free, non-destructive external exposure check in under 15 seconds.