Microsoft 365 is the most common business platform in NZ. It is also the most common entry point for attacks on NZ businesses — not because the platform is insecure, but because the security controls that matter most are not enabled by default and most businesses never turn them on.
CERT NZ's incident data consistently shows Microsoft 365 credential compromise as a leading cause of business email compromise, ransomware deployment, and data breach. The controls that prevent most of these incidents are included in the licence most businesses already pay for.
---
MFA — Still the Most Important Control
Multi-factor authentication on Microsoft 365 remains the single most impactful security control available, and a significant proportion of NZ SMEs still have it disabled or only partially enabled.
Common failure modes:
- MFA enabled for some users but not all — attackers target the accounts without it
- Legacy authentication protocols left enabled — attackers bypass MFA entirely by connecting via IMAP or POP3 rather than modern authentication
- MFA enrolled but set to SMS — interceptable; hardware token or authenticator app is the minimum standard
- Exempt accounts — "we disabled MFA for the CEO because it was inconvenient" — the most targeted account has the weakest protection
The fix: enable MFA for every account including shared mailboxes and administrative accounts, block legacy authentication protocols via Conditional Access, and move everyone off SMS to Microsoft Authenticator or a hardware key. The MFA guide covering SME deployment is at multi-factor authentication for small business.
Conditional Access — Unused by Most SMEs
Conditional Access is available in Microsoft 365 Business Premium and above. It evaluates every sign-in against a policy before granting access. Most SMEs with a qualifying licence have never configured it.
High-value policies that cost nothing beyond the existing licence:
- Require MFA for all users — the baseline, should be the first policy created
- Block legacy authentication — prevents IMAP, POP3, and other protocols that bypass MFA
- Require compliant device — only devices enrolled in Intune and meeting the compliance policy can access Microsoft 365
- Block sign-ins from high-risk locations — flagged country lists or anomalous travel detection
- Require MFA for all administrative role members — privileged accounts get a higher authentication bar
Each policy is a configuration change, not a cost. An SME that has not configured Conditional Access is leaving significant security value in its licence unused.
Audit Logging — Often Disabled
Microsoft 365 audit logging is not enabled by default in all tenants and all licence tiers. When it is disabled, there is no record of who accessed what, when, or from where. When an incident occurs — a compromised mailbox, a data exfiltration, an insider threat — the absence of logs means the investigation cannot proceed.
Enabling unified audit logging takes two minutes in the Microsoft 365 compliance centre. The log data should be retained for at least 90 days in the platform (longer with a suitable licence) and ideally forwarded to a SIEM or log management tool. At minimum, alerts on:
- Sign-ins from new countries
- Mass email deletion or forwarding rule creation
- File download volume anomalies from SharePoint
- New external sharing links on sensitive files
These are the signals that appear in most Microsoft 365 compromise investigations — and they are invisible without audit logging enabled.
External Email Warnings
Microsoft 365 can add a banner to every email that originates from outside the organisation. This single control makes phishing significantly harder — staff see immediately that an email claiming to be from the CEO, IT support, or a known supplier is actually arriving from an external address.
External email banners are disabled by default. Enabling them takes minutes via Exchange Online transport rules or Microsoft Defender configuration. The banner text should be explicit: "This email was sent from outside [Organisation Name]." This does not stop all phishing but it removes the appearance of internal legitimacy from most impersonation attacks.
Sharing Settings — Too Open By Default
Microsoft 365's default sharing settings in SharePoint and OneDrive allow files to be shared with anyone using a link — no authentication required. Files shared this way are accessible by anyone with the link, can be forwarded, and have no expiry.
For most NZ SMEs the right configuration is:
- External sharing restricted to existing guests (people already in the directory) or specific verified domains
- Sharing links default to "People with existing access" not "Anyone with the link"
- Link expiry enabled on any external sharing that does need to happen
- Sensitivity labels on confidential files that prevent external sharing entirely
These settings do not prevent collaboration — they require it to be deliberate rather than accidental.
Defender for Business — Underused
Microsoft 365 Business Premium includes Microsoft Defender for Business, an endpoint detection and response (EDR) tool. Most SMEs have the licence and have not deployed the agent.
Defender for Business provides:
- Behavioural detection on endpoints — it catches ransomware behaviour patterns before encryption begins
- Automated investigation and response — contains threats without waiting for an IT person to respond
- Vulnerability management — shows which endpoints have missing patches and known vulnerabilities
- Integration with Microsoft 365 sign-in risk signals
Deploying Defender for Business to all Windows endpoints takes an hour and requires no additional spend for Business Premium subscribers. The protection it provides against ransomware entry via compromised endpoint is material.
The Secure Score Baseline
Microsoft 365 includes a Secure Score in the Security Centre — a percentage-based assessment of the tenant's security configuration against Microsoft's recommended controls. Most NZ SMEs who have never reviewed their security configuration have a Secure Score below 30 percent. A tenant with MFA, Conditional Access, audit logging, external email banners, and Defender deployed typically sits above 60 percent.
Secure Score is not a compliance certification, but it is a useful baseline and a useful tracking tool. Running through the score recommendations with an IT person takes a half-day and typically closes the most significant gaps for free.
Training the People Behind the Settings
Technical controls stop what they are configured to stop. Phishing attacks that get past filters, credential harvesting pages that MFA cannot stop if the user hands over their session cookie, and social engineering that bypasses every technical control — these require the human layer. The cyber awareness training 2026 guide covers the training programme that complements the technical controls.
Practical Takeaway
- Enable MFA for every Microsoft 365 account including shared mailboxes
- Block legacy authentication via Conditional Access
- Create Conditional Access policies for device compliance and admin MFA
- Enable unified audit logging and set up alerts for key signals
- Add an external email banner to all inbound external email
- Tighten SharePoint and OneDrive sharing defaults
- Deploy Defender for Business to all Windows endpoints
- Review Secure Score and work through the top recommendations
Start your free SecureAZ trial to train your team on Microsoft 365 security hygiene and build the awareness programme that protects the human layer the settings cannot reach.
External references: