Microsoft 365 Security Settings for Grand Rapids SMBs

How many of your employees can sign in to Microsoft 365 with only a password? If the answer is more than zero, your business has an open door. Microsoft 365 security settings are the fastest, cheapest way for a Grand Rapids small business to cut its risk of email takeover and data theft.

Microsoft 365 is the main target for attackers hitting small firms. Phishing that steals a login leads to invoice fraud, client data exposure, and cyber insurance claims. Most of this is preventable with settings you already own. Evolv Technology Solutions configures and monitors these controls for West Michigan clients through our managed IT services.

Turn On Multi-Factor Authentication for Every User

MFA blocks the large majority of password-based account attacks. Enforce it for all users, including owners, shared mailboxes with sign-in, and service accounts where possible.

Use the Microsoft Authenticator app or passkeys. Avoid text message codes when you can. Use Conditional Access policies instead of per-user MFA so you can set rules by location, device, and risk.

CISA's Secure Our World guidance lists MFA as a top action for every organization.

Block Legacy Authentication and Risky Sign-Ins

Legacy protocols such as POP, IMAP, and old SMTP do not support MFA. Attackers use them to skip your protections. Block them with a Conditional Access policy unless a specific device truly needs them.

Add a rule to block sign-ins from countries where you do not do business. A Holland manufacturer has no reason to accept logins from overseas at 3 a.m.

Lock Down Email Against Phishing and Spoofing

Set up SPF, DKIM, and DMARC for your domain. These three records tell receiving servers that your email is real and block criminals from sending as you. Move DMARC to a "reject" policy once monitoring shows clean results.

Turn on Defender for Office 365 features such as Safe Links and Safe Attachments if your license includes them. Microsoft 365 Business Premium covers these for most SMBs and adds device management and advanced threat protection.

Disable automatic external forwarding. Attackers who break into a mailbox often add a hidden forwarding rule to watch your conversations.

Control Devices, Sharing, and Admin Access

Require devices to be enrolled and compliant before they open company data. That means disk encryption, screen locks, and current patches. Intune handles this in Business Premium.

Restrict external sharing in SharePoint and OneDrive. Default to "specific people" instead of "anyone with the link." Review sharing reports every quarter.

Limit global admin roles to two or three named people, each using a separate admin account with MFA. Day-to-day work should never happen from a global admin login.

Back Up Microsoft 365 and Monitor It

Microsoft protects its platform, but you own your data. Deleted files, ransomware, and rogue admins can still cause permanent loss. Use a third-party backup for Exchange, SharePoint, OneDrive, and Teams.

Turn on audit logging and alerts for new inbox rules, impossible travel, and mass file downloads. Someone has to watch those alerts. That is where a managed provider pays for itself.

What Insurers and Regulators Expect From Your Tenant

Cyber insurance applications now ask direct questions about Microsoft 365. Do you enforce MFA on email? Do you have endpoint protection on every device? Can you restore data after ransomware? Wrong answers raise premiums or void coverage after a claim.

Regulated Michigan firms face similar scrutiny. CPA firms must follow the IRS Written Information Security Plan requirements. Healthcare practices must safeguard PHI under HIPAA. Law firms must protect privileged client communication. A hardened tenant gives you the evidence to answer auditors with confidence.

Keep a simple record of your settings, who approved exceptions, and when you last reviewed them. That one document saves hours during an insurance renewal.

A 30-Day Microsoft 365 Hardening Plan

You do not need to fix everything at once. Work in this order.

In week one, enforce MFA for all users and block legacy authentication. This single step removes the most common attack path.

In week two, configure SPF, DKIM, and DMARC, and disable external auto-forwarding. Review the list of global admins and remove extras.

In week three, enroll devices, require encryption, and tighten SharePoint and OneDrive sharing. Test with a small group first so you catch problems before they reach everyone.

In week four, set up backup, audit alerts, and a monthly review. Assign a named person to read the alerts or hand that job to your managed provider.

Most 20 to 100 user businesses finish this plan in a month with outside help. Doing it alone often takes a quarter, because routine IT work keeps pushing it aside.

Why Small Firms Get Targeted First

Attackers know small businesses run lean IT teams. A Michigan firm with 40 users rarely has someone watching sign-in logs at night. Criminals buy stolen passwords in bulk, then test them against Microsoft 365 logins until one works. Once inside, they read email for weeks, learn how you bill clients, and send a fake invoice at the right moment.

One West Michigan business we reviewed had no MFA on three executive accounts and an old forwarding rule sending mail to an unknown address. Both fixes took under an hour. The cost of missing them would have been a wire fraud loss and a notification letter to every client.

Good settings do not slow your team down. Staff approve a prompt on their phone, and trusted devices stay signed in. The friction is small. The protection is large.

Frequently Asked Questions

What are the most important Microsoft 365 security settings for small business?

Enforce MFA for every user, block legacy authentication, configure SPF, DKIM, and DMARC, restrict external sharing, and require compliant devices. Evolv Technology Solutions applies these controls first for every new Michigan client.

Is Microsoft 365 secure by default?

No. Default settings favor convenience. Several protections need to be configured, and some require Business Premium or higher licensing. Evolv Technology Solutions audits tenants against a baseline and fixes gaps.

Do I need Microsoft 365 Business Premium?

Most businesses with client data should. It includes Defender, Intune, and Conditional Access, which cyber insurers and regulators increasingly expect. Evolv Technology Solutions can review your licensing and tell you what you actually need.

How much does it cost to secure a Microsoft 365 tenant?

Costs depend on user count and current state. A one-time hardening project plus ongoing monitoring is typically far cheaper than a single email compromise. Evolv Technology Solutions provides a fixed quote after a free tenant review.

Can Evolv manage Microsoft 365 for businesses in Grand Rapids?

Yes. Evolv Technology Solutions provides Microsoft 365 administration, security, backup, and help desk support to businesses across Grand Rapids and West Michigan.

Get a Free Microsoft 365 Security Review

Evolv Technology Solutions will review your tenant and show you the gaps that matter most. Schedule a free consultation at evolvtechsolutions.com. Law firms, CPA firms, and healthcare practices can also see our vCISO program for compliance-driven security leadership.