Office network security in SMEs — getting the Microsoft 365 baseline right
Office network security in SMEs — getting the Microsoft 365 baseline right
An SME's security does not require complicated purchases. Most of what is needed is already in Microsoft 365 — provided it is configured correctly. Five concrete things you can sort out in a week of work.
In many companies security feels either like an abstract obligation or an expensive project that requires consultants and a separate budget. In reality it is often much simpler: the environment already exists in the form of Microsoft 365, and the question is mostly whether it is set up correctly.
According to Microsoft's own analysis, more than 99 percent of account takeovers could be prevented by using verified sign-in (Microsoft, Digital Defense Report, 2024). International studies likewise show that the majority of other breaches involve a human element — usually someone tricked into clicking, or a password that was too weak. In other words: the biggest risks for a small company can be addressed through careful configuration and staff guidance, not expensive products.
Five things that form the baseline
The following five steps cover most situations where an SME runs into security trouble. They are the same steps recommended by the Finnish Cybersecurity Centre and the EU's cybersecurity agency ENISA.
1. Verifying sign-in via phone or app
This is the single step that brings, by a wide margin, the largest benefit. In practice it means that in addition to the password, sign-in must be confirmed via a code sent to the phone or via a separate app. The technical name is multi-factor authentication (MFA), but in practice it is enough to remember that a password alone is no longer enough.
In Microsoft 365 the feature is included in the price and requires no additional purchase. It must be enforced for everyone — including the CEO, who is the favourite target for attackers. Microsoft's Security Defaults setting does this automatically, but on older accounts it is often left disabled.
2. Sign-in rules for different situations
On top of verification you should add more specific rules: confirmation is required whenever sign-in comes from an unknown device or unusual location; sign-in is blocked entirely from countries where your company does not operate; sensitive data is accessible only from managed devices. Microsoft calls this Conditional Access.
For users the change is minimal — most sign-ins involve nothing extra. But for an attacker, the door closes almost completely.
3. Email authentication — so no one can impersonate your company
A common attacker tactic is to send a message that appears to come from the CEO or a trusted supplier — for example asking to redirect a salary payment to a different account. This can be prevented by adding three authentication records to your domain that prove to the receiving server that the message really comes from your email server.
The technical names are SPF, DKIM and DMARC. You don't need to remember them — it is enough to ask your IT partner for an hour of work to add these to your domain settings. One-off, free, but affects every future fraud attempt.
4. Enhanced email protection
Microsoft's better licences (Business Premium) include an add-on service that checks email links at the moment of click, runs attachments in an isolated environment and provides tools for regular staff exercises. The technical name is Defender for Office 365, but in practice it is Microsoft's own enhanced email protection. This does not make the basics unnecessary — it complements them.
5. Company device management and disk protection
Microsoft's device management service (Intune) manages company devices centrally: all computers are enforced to use disk encryption (BitLocker), lost devices can be wiped remotely, and updates are installed centrally — not left for users to handle. The same logic applies to phones.
Without device management, the risk of a single stolen laptop is the loss of the entire company's data. From an unencrypted disk, all files can be extracted in ten minutes.
What this requires in practice
Everything mentioned above — verified sign-in, conditional access rules, enhanced email protection and device management — is included in Microsoft 365's better licences. No separate purchases are needed; these are activated within the existing environment.
The implementation effort is moderate. One calendar week is enough when the work is split: day one verified sign-in and Security Defaults on, day two email authentication records, day three sign-in rules, day four enhanced email protection and device enrolment, day five staff guidance.
Common pitfalls
The same trouble spots repeat in practice:
- Verified sign-in is enabled, but only for admins. Attackers target ordinary users, through whom they get inside.
- Automatic email forwarding rules go unnoticed. When an attacker breaks into a mailbox, they often install a rule that copies messages to their own mailbox. Such rules need to be reviewed regularly.
- Personal devices (Bring Your Own Device, BYOD) sit outside management. A practical compromise: require at least a baseline device security check before company email is synced to a phone.
- Updates are left to the user. This does not work. The device management service handles updates centrally, keeping devices current without user effort.
Where to start
If your company's security baseline is not yet in place, the order is clear.
- Activate Microsoft Security Defaults immediately. With one click you get verified sign-in across the organisation and legacy sign-in methods blocked. By Microsoft's own data this alone blocks the majority of account attacks.
- Add email authentication records to your domain. Start with a cautious mode (reporting only), watch for a month which messages would be rejected, and once you are confident all your company messages are in order, switch on rejection.
- Upgrade licences to Microsoft Business Premium and enable basic sign-in rules. This is the only step that requires a licence upgrade, but the benefit over the baseline is large.
SME security is not a marathon, but a proper foundation. With the foundation in place, more advanced solutions are a natural next step only when the organisation grows. For most SMEs the baseline takes you a long way.