The Small Business M365 Security Audit: How to Implement Automated Phishing Training and Lock Down Your Configuration

Microsoft 365 powers approximately 465 million subscriptions worldwide, and a large percentage of those belong to small businesses. The platform handles email, file storage, team collaboration, and identity management all in one place. That convenience comes with a catch: misconfigured settings create openings that attackers actively target.

Small business cyber attack statistics 2024 show that companies with fewer than 100 employees face the highest rate of targeted phishing attacks per employee. The reason is straightforward. Smaller organizations typically lack dedicated IT security staff, which means default settings stay default, security features remain disabled, and employees receive minimal training on recognizing threats.

Part 1: Identity and Access Controls

Most breaches start with a compromised account. Your first audit priority should focus on how users log in and what they can access.

Multi-Factor Authentication (MFA)

Check this first. Go to the Microsoft Entra admin center (formerly Azure AD). MFA is managed exclusively through Authentication Methods and Conditional Access policies. Every account should have MFA required by policy. The legacy per-user MFA portal was retired in September 2025, meaning identity security is now handled through these modern policy tools.

For businesses on Microsoft 365 Business Premium or higher, use Conditional Access policies. This gives you more control. You can require MFA for specific conditions, like signing in from outside your country or accessing sensitive applications.

Audit action: Document which accounts lack MFA enforcement. Prioritize admin accounts and any user with access to financial data or customer information.

Admin Account Separation

Your Global Administrator account should never be used for daily email and document work. Create separate admin accounts that exist only for administrative tasks. These accounts should have MFA enabled with a hardware security key or authenticator app (never SMS).

Check how many Global Admins you have. Most small businesses need two or three at most. Go to Roles and administrators in the Entra admin center to see the current list.

Password Policies

Microsoft’s current guidance recommends against forced periodic password changes, which research shows often leads to weaker passwords. Instead, configure your tenant to:

• Block common passwords (enabled by default, but verify)
• Require passwords of at least 12 characters
• Enable self-service password reset to reduce help desk burden

Find these settings under Password protection in the Entra admin center.

Part 2: Email Security Configuration

Email remains the primary attack vector for small businesses. M365 includes several protective features, but they require proper configuration.

Safe Links and Safe Attachments

These features scan URLs and attachments in real-time. If you have Microsoft Defender for Office 365 (included in Business Premium), verify these are turned on.

In the Microsoft Defender portal, go to Policies & rules, then Threat policies. Check that Safe Links policies apply to all users and that Safe Attachments is set to block detected malware.

A common mistake: organizations create these policies but scope them too narrowly, leaving some users unprotected.

Anti-Phishing Policies

Default anti-phishing policies provide baseline protection, but you should customize them. In the same Threat policies area, review your anti-phishing settings:

• Enable mailbox intelligence (learns user communication patterns)
• Turn on spoof intelligence
• Add your executives and finance team to impersonation protection
• Configure actions for detected threats (quarantine rather than just tag)

The impersonation protection feature specifically guards against attackers pretending to be your CEO or CFO in business email compromise schemes.

External Email Tagging

A simple but effective control: tag all emails from outside your organization with a visible warning. This helps employees pause before trusting messages that appear to come from colleagues but actually originate externally.

Enable this in Exchange admin center under Mail flow, then Rules. Create a rule that prepends “[EXTERNAL]” to the subject line or adds a banner to the message body.

Part 3: How to Implement Automated Phishing Training

Technical controls catch many threats, but some phishing emails will reach your employees. Research from UC San Diego found that traditional annual security training has limited effectiveness. Employees forget what they learned, and attackers constantly develop new tactics.

Automated phishing simulations address this gap by providing ongoing, practical experience. Employees encounter realistic phishing attempts in their actual inbox, and those who click receive immediate feedback explaining what they missed.

Setting Up Simulation Campaigns

Microsoft Defender for Office 365 Plan 2 includes Attack Simulation Training. If your license includes this feature, access it through the Microsoft Defender portal under Email & collaboration, then Attack simulation training.

For businesses without this license tier, third-party platforms offer automated simulations designed specifically for small businesses. These tools typically require minimal setup and can run continuously without ongoing management.

When configuring simulations:

• Start with moderate difficulty, then increase based on results
• Use templates relevant to your industry (invoice scams for businesses handling payments, for example)
• Schedule simulations to run regularly, not just quarterly
• Make sure immediate training triggers when someone clicks

Measuring Employee Security Training ROI

Track your simulation results over time. The metrics that matter for employee security training ROI small business calculations include:

• Click rate (percentage who click malicious links)
• Report rate (percentage who correctly report phishing)
• Repeat offenders (users who fail multiple simulations)

A well-run program should show declining click rates and increasing report rates over 6 to 12 months. Published research on phishing training suggests that combining cue-based training with regular simulations produces better results than either approach alone.

See our SaaS security audit guide for steps on connecting your phishing training program to your broader security posture.

Part 4: Data Protection Settings

Preventing unauthorized data access and accidental exposure requires attention to sharing settings and information protection.

SharePoint and OneDrive Sharing

Default sharing settings in M365 are often more permissive than small businesses need. In the SharePoint admin center, review these settings:

• External sharing level (consider limiting to “Existing guests” or “Only people in your organization”)
• Default link type (set to “Specific people” rather than “Anyone with the link”)
• Guest access expiration (enable automatic expiration for external sharing links)

Many data exposures happen when employees create “Anyone” links and those links get forwarded or indexed by search engines.

Teams External Access

Microsoft Teams introduces additional sharing considerations. In the Teams admin center, audit:

• External access settings (who can communicate with your users from outside)
• Guest access settings (what guests can do within your Teams)
• Meeting policies (can anonymous users join meetings?)

Follow these detailed configuration recommendations to secure Teams against social engineering.

Part 5: Monitoring and Response

Security settings mean little without visibility into what’s happening in your environment.

Audit Logging

Verify that unified audit logging is enabled. In the Microsoft Purview compliance portal, go to Audit and confirm the feature is active. This logs user and admin activities across M365 services.

Audit logs help you investigate incidents after they occur. Without them, you’re working blind when trying to understand what happened during a breach.

Alert Policies

M365 includes default alert policies for suspicious activities. Review these in the Defender portal under Policies & rules, then Alert policy. Consider enabling alerts for:

• Unusual external file sharing
• Mail forwarding rules created (a common persistence technique)
• Elevation of privileges
• Multiple failed login attempts

Configure alerts to notify someone who will actually respond. An alert that goes to an unmonitored inbox provides no protection.

Secure Score Review

Microsoft Secure Score provides a numerical rating of your security posture along with specific recommendations. Access it in the Microsoft Defender portal. While you shouldn’t chase the highest possible score (some recommendations won’t fit your business), reviewing the list monthly helps identify gaps you may have missed.

CISA’s guidance for small businesses recommends combining technical controls with ongoing employee awareness, which aligns with using Secure Score alongside regular phishing simulations.

Putting It Together: Your Monthly Audit Schedule

A one-time audit helps, but security requires ongoing attention. Consider this monthly schedule:

Week 1: Review admin accounts and MFA status. Check for new Global Admins or disabled MFA.

Week 2: Review phishing simulation results. Identify users who need additional training.

Week 3: Check sharing settings and external access. Look for overly permissive configurations.

Week 4: Review Secure Score and alerts. Address any new recommendations or triggered alerts.

This schedule takes perhaps an hour per week for a small business. The alternative, discovering a breach months after it occurred, costs far more in time, money, and customer trust.

Your M365 subscription includes powerful security tools. The difference between protected and vulnerable often comes down to whether someone took the time to configure them properly and train employees to recognize the threats that slip through.

Start Building Your Human Firewall

Launch a realistic phishing simulation in minutes and get the tools you need to build a cyber-aware team.

Send Me a Sample Test