Microsoft 365 Security Best Practices for South African SMBs

Short answer: For most South African SMBs, start by enforcing MFA for every user (Security Defaults on Business Basic or Standard, or Conditional Access on Business Premium) and locking down admin accounts. Then tune email protection to your licence, remove leavers and dormant access, and confirm audit logging is on, in that order.

Paying for Microsoft 365 doesn’t mean your Microsoft 365 is secure. Most of the protection a 10 to 50 person firm needs is already in the box, but a lot of it is off, half-configured, or switched on once and never checked again.

If you run or manage an engineering practice, an architecture studio, a law firm, an accounting office or a financial planning business in the Western Cape, the order matters more than the checklist. Start with identity, then admin accounts and email, then leavers and logging. And match each step to the licence you actually pay for, because Business Basic, Business Standard and Business Premium don’t get the same tools.

This guide walks through that order, what changes by licence, and what should be checked every month so the settings don’t quietly drift.

Why default Microsoft 365 isn’t a security programme

Microsoft builds 365 to be easy to start using. That’s good for adoption, and it’s why so many tenants are set up in an afternoon and left alone for years. Security, though, is a set of decisions someone has to own: who can sign in, from where, with what proof, who holds admin rights, and what gets recorded when something goes wrong.

For professional firms, the risk that bites hardest is usually business email compromise. Someone gets into one mailbox, watches the invoices and trust-account conversations for a week, then sends a “change of banking details” email that looks exactly right. No malware, no dramatic ransom screen. Just a sign-in that should have been blocked.

That’s the gap this guide closes: not more features, but the right features switched on, in the right order, and owned.

First 30 days: do these in order

1. MFA for every user, on the path your licence supports

Multi-factor authentication (MFA) means signing in takes a password plus a second proof, usually an approval in the Microsoft Authenticator app. A stolen password on its own stops being enough.

There are two ways to enforce it, and you use one or the other, not both:

• Security Defaults. Free, and available on every Business plan. It requires everyone to register for MFA, challenges sign-ins when Microsoft judges it necessary, protects admin roles more strictly, and blocks legacy authentication (older sign-in methods that can’t do MFA). For most firms on Business Basic or Standard, this is the right baseline, and it takes minutes to turn on.
• Conditional Access. Rules that decide access based on who the user is, where they’re signing in from, and what device they’re on. It needs Microsoft Entra ID P1, which is included in Business Premium. It’s more flexible, but it only protects you if the policies are designed properly and reviewed.

Whichever path you’re on, make sure legacy authentication is blocked and that “everyone” really means everyone, including the shared reception mailbox and the partner who “never uses email on their phone”.

2. Protect the admin accounts

Global Admin is the key to the whole tenant, so treat it that way:

• Keep the number of Global Admins small. Most firms need two or three, not a list of everyone who once asked for help.
• Give admins a separate admin account and keep day-to-day email and browsing on their normal account.
• Set up an emergency “break-glass” account, stored securely and monitored, so you aren’t locked out if MFA or a policy goes wrong.
• Review admin roles whenever someone changes role or leaves.

For our managed clients, 2KR holds the Global Admin role on a dedicated admin account that isn’t used for email or browsing, and the firm keeps its own admin count to the one or two people who need it. Every tenant also gets a monitored break-glass account with its credentials stored in an encrypted vault, so a locked-out firm is a phone call away from access, not a support ticket to Microsoft.

3. Email protection that matches your licence

Every Microsoft 365 Business plan includes Exchange Online Protection, which filters spam and known malware. That’s the floor, not the finish line. Check that its anti-spam and anti-phishing policies are actually tuned, not left at whatever was there on day one.

Business Premium adds Microsoft Defender for Office 365 Plan 1. That brings Safe Links (links in emails are checked again at the moment someone clicks), Safe Attachments (suspicious files are opened in a sandbox before delivery) and stronger impersonation protection for the names and domains your staff trust. On Basic or Standard you can buy it as an add-on, but it isn’t there by default, so don’t go looking for a Safe Links setting your licence doesn’t have.

Email security also lives outside Microsoft 365. Your domain’s SPF, DKIM and DMARC records decide whether someone can send convincing email as you. We cover that in how DMARC protects your business from email threats and 6 simple steps to enhance your email security.

4. Clean up permissions and leavers

Tenants pick up access the way offices pick up old files. A candidate attorney who finished articles last year still has an active account. A staff member was made admin for a once-off job and nobody took it back. A shared mailbox is open to half the firm.

Go through every user and ask three questions: is this person still here, do they need this access, and do they need admin rights at all. Then fix your offboarding so the problem doesn’t rebuild itself. When someone leaves, block sign-in the same day, revoke sessions, and hand their mailbox and files to the right person. Our guide on proper employee offboarding has the full checklist.

5. Turn on audit logging and alerts before you need them

Unified audit logging records what happens in your tenant: sign-ins, file access and sharing, mailbox rule changes, and emails forwarded outside the firm. Microsoft now turns it on for most tenants, but “most” isn’t “yours”, so confirm it’s running.

Then set alerts for the signals that usually come before a business email compromise: a new inbox rule that forwards or deletes mail, sign-ins from unexpected countries, and a sudden spike in file downloads. If something does go wrong, the log is how you work out what happened, when it started and what was touched.

If a mailbox is compromised, you’ll need to work out quickly what was exposed and who’s affected, including whether POPIA’s notification rules apply. You can only do that if you can see what the attacker touched, and that’s what the audit log is for.

Business Basic and Standard vs Business Premium

This is where most generic checklists go wrong, so here’s the split plainly:

Basic or Standard, set up properly, is a far better position than Premium left at defaults. Premium starts to earn its place when you handle sensitive client records, have staff working from personal devices, or get asked hard questions on a client or insurer security questionnaire. That’s a conversation about your risk, not a reason to upgrade everyone tomorrow.

Microsoft 365’s retention and recycle bin features are not a full backup of your tenant on any plan, so recovery planning needs to be handled as its own piece of work.

Sharing, devices and data

On every plan: tighten external sharing in SharePoint and OneDrive. Default sharing links to “specific people” instead of “anyone with the link”, set guest access to expire, and review who outside the firm can still open your files. It costs nothing and closes one of the most common leaks.

On Business Premium: Intune lets you require that laptops and phones meet a standard (encrypted, up to date, screen lock on) before they reach firm data, and lets you wipe firm data from a lost or departed staff member’s device. Purview DLP can spot things like South African ID numbers or banking details in an email or shared file and warn the sender or block it. Both need planning, so roll them out with your team rather than switching them on cold.

What 2KR checks so settings don’t drift

Security settings don’t fail in one go. They drift. A new starter is created outside the normal process, a policy is relaxed “just for this week”, a guest link outlives the project. That’s why we treat Microsoft 365 security as something owned month after month, not a one-off project.

Every month, on every managed tenant, we check:

• MFA coverage: every active user registered, no exclusions that crept in during a “just for this week” fix
• Admin roles: the names and count match what was agreed with the firm, and nobody kept a role from a once-off job
• Mail forwarding and inbox rules: anything moving firm email outside the firm, or quietly deleting it
• Sign-in activity: logins from unexpected countries or at odd hours, and accounts that haven’t signed in for 30 days
• Guest and external sharing: links and guest accounts that outlived their project
• Licences and leavers: licences still assigned to people who’ve left, and departed staff whose accounts are still active
• Secure Score: the trend over the last quarter, and the recommendations worth acting on for a firm this size

Between those reviews, the tenant is watched continuously by Huntress for the signals that come before a compromise: a new forwarding rule, a sign-in from a country the firm doesn’t work with, a token stolen from a browser session. So the first we hear of a problem isn’t a client asking why an invoice went to the wrong bank account.

Ownership is the point. When one team owns the configuration and reviews it on a schedule, someone notices the drift before an attacker does. That’s what we mean by Ownership changes everything.

POPIA-minded safeguards (not legal advice)

The Protection of Personal Information Act asks responsible parties to take appropriate, reasonable measures to protect the personal information they hold. Microsoft 365 doesn’t make you compliant by itself, and no subscription does. What a well-configured tenant gives you is practical safeguards that support those duties: controlled access, MFA, least-privilege admin rights, tighter sharing, and a log of who did what.

For legal obligations, speak to your legal adviser or Information Officer. Our part is the IT hygiene that makes those obligations easier to meet.

FAQ

What should a small business turn on first in Microsoft 365?

Start with identity. Enforce MFA for every user (Security Defaults on Business Basic or Standard, or Conditional Access with Entra ID P1 on Business Premium), block legacy authentication, and lock down admin accounts. Then tighten email protection to your licence level, remove leavers and dormant access, and make sure audit logging is on.

Should we use Security Defaults or Conditional Access?

Security Defaults are a solid baseline and need no extra licence. Conditional Access adds rules based on user, location and device, and needs at least Entra ID P1, which comes with Business Premium. You can’t run both, so pick the one that matches your licences and how much control you need.

Is Business Basic or Standard secure enough?

For many small firms, yes, if it’s configured properly and checked regularly. Business Premium matters more when you hold sensitive client records, allow personal devices, or need device management, data loss prevention and stronger email protection.

Does Microsoft 365 make us POPIA compliant?

No. Configured well, it supports practical safeguards like access control, MFA, logging and tighter sharing that help protect personal information. That’s IT hygiene in support of your POPIA duties, not legal advice.

What should an IT provider check every month?

At minimum: MFA coverage, admin roles, mail forwarding and inbox rules, sign-in activity and dormant accounts, external sharing, licences assigned to leavers, and Secure Score. If your provider can’t show you the last time they checked these, that’s the real finding.

Want someone to own this for you?

If you’re not sure what’s switched on in your tenant, or which licence path fits your firm, we’re happy to talk it through. Book a free 15-minute conversation with 2KR. See how we run IT support in Cape Town, browse our services, or contact us on 021 065 1824.

Not ready for a call? Download The Small Business IT Buyer’s Guide: 12 things to know before choosing a new IT provider, including the questions to ask about Microsoft 365 security. Download here

For the productivity side of Microsoft 365 (Teams, OneDrive and Focused Inbox), see Microsoft 365 essential settings to maximise your experience. For how attackers are using AI to make phishing harder to spot, read Phishing 2.0.