Microsoft 365 Default Settings: The Mail Doors SMEs Leave Open | APX Digital

38% of UK businesses took a phishing attack last year, and 69% of those that were breached called it their most disruptive. Most of them were running Microsoft 365 with the settings Microsoft shipped. Here are the four defaults that leave the door open.

What actually ships on in a small-business Microsoft 365 tenant, straight from Microsoft's own documentation.

As of September 2026, phishing remains the most prevalent attack on UK businesses by a wide margin; 38% of businesses experienced phishing attacks in the last 12 months, and among businesses that were breached, 69% named phishing as the most disruptive type (Cyber Security Breaches Survey 2025/2026, gov.uk). Impersonating your finance director's signature is routine, not exotic.

The uncomfortable part: Microsoft's defaults are genuinely better than they were, and they're still not enough for a tenant nobody administers. Four things we find on almost every small-business tenant we review; every claim below sourced from Microsoft's own docs this month.

1. Safe Links and Safe Attachments are licence-gated, and most SMEs don't have them

The link-scanning and attachment-detonation features people assume are "just Microsoft 365" are Defender for Office 365 features. Microsoft's service description is explicit: Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing policy, real-time detections) is included in Microsoft 365 Business Premium, and effective 1 July 2026 in Office 365 E3 / Microsoft 365 E3. On Business Standard (the most popular SME seat), you get the baseline Exchange Online Protection: spam and malware filtering, but no Safe Links time-of-click protection and no Safe Attachments detonation. Microsoft's Safe Attachments documentation also notes there is no default Safe Attachments policy even once you hold the licence; protection only exists if someone configures it.

So on a Standard tenant: a malicious link clicked on Friday is re-checked never, and a new-variant attachment is only caught if signature/behavioural anti-malware happens to know it already.

2. Security defaults help, unless someone turned them off in 2020

Microsoft's security defaults require MFA registration for all users and block legacy authentication; Microsoft states more than 99.9% of common identity attacks (password spray, replay, phishing-driven) are stopped by MFA plus legacy-auth blocking. New tenants get them rolled out at creation, with a 24-hour grace period. The two leaks: tenants created before the rollout often have them disabled because one scanned copier couldn't do MFA, and tenants with Entra ID P1 licences (Business Premium) frequently have security defaults off in favour of Conditional Access that was never actually configured. Leaving security defaults off removes the MFA and legacy-auth blocks those tenants rely on.

3. SMTP AUTH stays on for the scanner

Authenticated SMTP (port 587) is how multifunction printers, report servers and line-of-business apps send mail. Microsoft's SMTP AUTH documentation says virtually all modern clients don't need it and recommends disabling it org-wide, enabling per-mailbox only where required. The scan-to-email box from 2018 has one exception account, and that account usually has a password that's never changed, no MFA (it can't do it), and lives in the same directory as your finance director.

The clock is running on that setup, not just your diligence: Microsoft's updated deprecation timeline (Exchange Team, January 2026) disables SMTP AUTH Basic Authentication by default for existing tenants from end of December 2026, and makes it unavailable by default for new tenants after that. Plan the scanner migration this quarter.

4. External-forwarding and auto-forward rules nobody wrote

Inbound phish, one inbox rule, your invoices silently BCC'd to a Gmail address. Baseline tenants don't alert on this. A configured tenant with audit logging does.

The fix list, in order of pain-per-pound

• [ ] Check your actual licences; Business Standard ≠ Defender protection. Costed honestly, moving key staff to Business Premium is usually cheaper than one breach in the £4,000 to £12,500 tail our breach-maths post quantifies.
• [ ] Turn security defaults on, or build Conditional Access properly. No half-state.
• [ ] Disable SMTP AUTH tenant-wide; re-enable per mailbox for exactly the devices that need it, and give the scanner an app-style credential you rotate.
• [ ] If licensed: enable Standard + Strict preset security policies and Safe Attachments for SharePoint/OneDrive/Teams.
• [ ] Alert on auto-forwarding rules and new transport rules.

The rest of your attack surface is physical: the CCTV and router defaults are covered in the PSTI password audit.

We harden M365 tenants for SMEs: licence review, identity, mail flow, evidence it worked. apxdigital.io/cyber · General IT support: apxdigital.io/it-support

Info@apxdigital.io · 07753 226214 · Birmingham / Coventry / West Midlands