Microsoft 365 security, set up properly

Most small businesses now run on Microsoft 365 — email, files, Teams, and the sign-in that ties them all together. That sign-in is where attacks actually start. The FBI’s internet crime reports consistently rank business email compromise among the costliest cybercrimes, and it rarely involves a firewall at all: someone gets a password, reads the mailbox, and waits for the right invoice to redirect.

Microsoft includes strong security tools, but a tenant left as it was on day one leaves most of them unused or half-configured. We set them up deliberately. Identity is familiar ground: our engineers have run Active Directory and Entra ID at scale, in environments spanning hundreds of domain controllers. Entra ID — the identity service behind every Microsoft 365 sign-in, known until 2023 as Azure Active Directory — is the same discipline in the cloud.

Real security, without the hassle

Security that makes everyday work painful does not stay in place. People find workarounds — a personal Dropbox, a shared password, an MFA prompt approved without reading it — and the business ends up less safe than before it started. So everything we put in place follows three rules:

• Stop the attacks that actually happen. Stolen passwords, phishing, invoice fraud and ransomware — not theoretical threats that sell software.
• Make the secure way the easy way. A trusted laptop at your desk signs in smoothly. Extra checks appear when something looks unusual, not every time.
• Nobody gets locked out without a way back in. Self-service password reset, emergency access accounts, and every change tested before it reaches everyone.

Twelve practices we put in place

A boiled-down baseline for Microsoft 365 and the devices that use it. Each is chosen for how much risk it removes against how little it gets in the way — and for each one, here is what it stops and what your team will actually notice.

Conditional Access, Intune device management and Defender for Business come with Microsoft 365 Business Premium. Most of the rest works on any Microsoft 365 business plan. We will tell you plainly whether an upgrade earns its cost for a business your size.

What we deliberately do not do

Some common “security” settings do more harm than good, because they push people toward workarounds nobody can see.

• Force password changes every 90 days. Current NIST guidance advises against it without evidence of compromise — it produces predictable passwords, not stronger ones.
• Prompt for MFA on every single sign-in. Constant prompts train people to approve without reading, which is exactly what attackers count on.
• Ban external sharing outright. Files go out anyway — by personal email or a consumer Dropbox, where nobody can see or revoke them.
• Take control of personal phones. Staff understandably refuse, and work email ends up somewhere less protected.
• Switch everything on in one day. New sign-in rules run in report-only mode first, so we see who would be blocked before anyone actually is.

How we roll it out

What we do

Security work that stands up to an auditor, a client questionnaire, or an actual incident.

• Security risk assessment — what you are actually exposed to, ranked
• Network security — firewalls, segmentation, VPN, guest isolation
• Endpoint protection and MFA rolled out so it is used, not bypassed
• Email security — phishing defense, SPF/DKIM/DMARC
• Backup and recovery designed against ransomware, not just hardware failure
• Compliance — evidence and controls, not a checklist someone signed

Compliance work

Colorado Springs runs on defense and healthcare. We handle both frameworks directly — see CMMC compliance for defense contractors and HIPAA compliance for clinics and practices.

Frequently asked questions