Most Microsoft 365 tenants are running almost entirely on whatever Microsoft switched on by default when the account was first set up. That's not necessarily wrong, but it's rarely right for a specific business either. A handful of settings make a disproportionate difference, and most of them take minutes to check.
External sharing defaults
By default, SharePoint and OneDrive often allow files to be shared with "anyone with the link," not just people inside the business. That's convenient right up until a genuinely sensitive file gets forwarded somewhere it shouldn't. Tightening this to "specific people" as the default, with wider sharing as a deliberate exception rather than the norm, closes one of the most common accidental leaks.
Multi-factor authentication enforcement
Having MFA available isn't the same as having it required. It's worth checking whether it's actually enforced for every user, not just switched on and left optional, since an optional security control tends to end up being used by exactly the people who needed it least.
Mailbox forwarding rules
Auto-forwarding rules to external addresses are a favourite trick for anyone who's compromised an account - quietly forward a copy of every email out, without the account owner noticing anything different day to day. It's worth checking whether external forwarding is blocked by default, and reviewing what rules already exist.
Legacy authentication
Older sign-in methods that don't support modern security checks are still switched on in a lot of tenants, mostly because nobody's actively disabled them. They're also one of the more common ways MFA gets bypassed entirely, since they were never built with it in mind. Turning them off closes a gap most businesses don't know is open.
Guest access and old accounts
Former contractors, old suppliers, guest accounts from a project that finished a year ago - access tends to accumulate and rarely gets tidied up on its own. A periodic check of who actually still has access, versus who's listed as having access, is worth doing on a schedule rather than never.
Why this matters more than it looks
None of these settings are complicated individually. What makes them worth checking is that they're invisible day to day - nothing about a loose sharing default or a forgotten guest account announces itself, right up until it's the reason something's gone wrong.
If you're not sure what your own tenant's defaults actually are, book a complimentary IT call and we'll take a proper look.
