Start with account security
Check who has admin access. Where possible, use a separate account for admin work and everyday email. Use multi-factor authentication (MFA), which adds another sign-in check, and close accounts that are no longer needed.
The security tools available depend on your subscription. Microsoft's security defaults or Conditional Access rules may help. Review and test changes before using them across the business so you do not lock users out.
Check email settings
Review SPF, DKIM and DMARC, which help receiving mail systems check emails sent using your domain. Plan changes with your mail provider. These checks do not guarantee delivery or stop every phishing email.
Check email forwarding rules and who can open each mailbox. Investigate changes you do not recognise, especially if an account may have been accessed without permission.
Check who can share and open files
Teams, SharePoint and OneDrive make it easier to share files. Check who can use shared links, whether outside guests still need access and whether any files are shared too widely.
Give each important site and team a clear owner. They can help review access when a project ends or someone leaves.
Check backups and review settings
Deleted-file recovery and version history have limits that depend on your settings and licences. Check what can be restored and whether you need a separate backup service.
Review accounts, security advice and major settings changes regularly. Use current Microsoft guidance and qualified support when choosing settings for your business.
Need help with the next step?
Need help applying these ideas to your business? Explore our Microsoft 365 Support services or talk to Blue Stone about what you need.