Essential Microsoft 365 security settings for Australian small businesses
Email remains a prime target for cybercriminals, especially for Australian small businesses. Microsoft Defender for Office 365 offers robust protection, but many organisations aren't using its full potential. Turning on the right settings can significantly bolster your defences against phishing, malware, and Business Email Compromise (BEC). These essential Microsoft 365 security settings are worth implementing today to safeguard your business communications. They're practical steps you can take to make a real difference in your cyber posture.
Why are enhanced Microsoft 365 security settings crucial now?
Enhanced Microsoft 365 security settings are crucial because email threats are increasingly sophisticated and costly for Australian small businesses. Cybercriminals frequently use tactics like phishing and BEC to gain access to systems or trick employees into transferring funds. The Australian Signals Directorate's annual threat report consistently highlights email-based attacks as a major vector for cyber incidents. Proactively configuring Defender for Office 365 helps prevent these attacks from ever reaching your inboxes.
How do you protect against Business Email Compromise (BEC) in Microsoft 365?
To protect against Business Email Compromise (BEC) in Microsoft 365, focus on anti-phishing policies and spoof intelligence. Create and customise anti-phishing policies to detect and block impostor emails that attempt to mimic trusted senders, whether internal or external. Configure spoof intelligence to identify and quarantine messages from unauthorised senders pretending to be part of your domain. These settings are vital for any Australian small business looking to prevent financial loss and reputational damage from BEC attacks. If you're unsure how to set these up, you can book a free 15-minute audit chat with Neil.
What 'Safe Attachments' settings should Australian small businesses enable?
Australian small businesses should enable 'Safe Attachments' settings to scan email attachments for malware before they reach users. Configure Safe Attachments policies to 'Dynamic Delivery' or 'Block' for unknown malware. Dynamic Delivery allows the email body to be read while the attachment is being scanned, and if malware is detected, the attachment is removed or replaced with a placeholder. This prevents malicious files from executing and potentially compromising your systems, aligning with the ACSC's advice on preventing malware.
Should you turn on 'Safe Links' for enhanced email protection?
Yes, you should turn on 'Safe Links' for enhanced email protection as it helps prevent users from clicking on malicious URLs. Safe Links rewrites URLs in emails and Office documents, then scans them in real-time when clicked to ensure they are not malicious. This means if a link that initially seemed safe later becomes dangerous, Safe Links will still block access. It's a key defence layer against phishing attempts that try to redirect users to fake websites to steal credentials. Don't leave your users exposed; get these settings checked during a free 15-minute audit chat with Neil.
What anti-spam and anti-malware policies are essential for small businesses?
Essential anti-spam and anti-malware policies for small businesses include setting appropriate action levels for detected threats. For anti-malware, ensure that 'Common Attachment Types Filter' is enabled to block known dangerous file types. For anti-spam, configure the 'Bulk Complaint Level' (BCL) and set actions for high confidence phishing and spam to quarantine or move to junk. Regularly review quarantined messages to fine-tune these settings and minimise legitimate emails being caught.
Proactively configuring Microsoft Defender for Office 365 is a critical step for any Australian small business serious about cyber security. These settings aren't just about ticking boxes; they're about building a robust defence against the everyday threats that target your email. Take action today to protect your business.
Sources
Every reference below was link-checked when this article was published.
- 1.Microsoft Defender for Office 365 security recommendationsMicrosoft Learn
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
