Secure your business

If criminals get the username and password of you or one of your team, they'll try to sign into your system to see what they can take. Using multifactor authentication makes it much harder for them to get in, even if they do have your username and password.

To confirm multifactor authentication is on:

1. Go to the Microsoft 365 admin center at https://admin.microsoft.com. 

2. Select Show all, then All admin centers to display the additional admin centers, and then select Microsoft Entra.
   
   

3. Select Identity from the navigation on the left, then Properties.
   
   

4. Select Manage security defaults from the bottom of the page.
   
   

5. On the panel that opens to the right, Enabled (recommended) should be select. If not, select it from the menu and then select Save.
   
   

If you have to enable the setting, the next time you sign into Microsoft 365 you'll be prompted to set up the Microsoft Authenticator app as a second factor. It should take just a couple of minutes to download and set up the app on your Android or iPhone. Once it's set up, you're all set. For more details on how to do it see Set up Security info from a sign-in page.

For regular users it should rarely ask for the second factor when they sign into the device they always sign into. For admin users it may ask a little more often due to the sensitive nature of an admin account.

Phishing messages are often cleverly disguised to look like a message from a person or organization you trust. If you do a lot of business with alexw@contoso.com you're inclined to trust Alex and you might not notice if a message came in from alexw@contos0.com during a busy day.

Microsoft 365 can add a safety tip to that message alerting you that this is a new sender, and that might give you a chance to pause and recognize that this message is from an imposter.

To turn on the first contact safety tip.

1. In your browser sign into https://security.microsoft.com/antiphishing.

2. Select the default anti-phishing policy from the list.

3. Select Edit actions. 
   
   

4. Select the check box for Show first contact safety tip.
   
   

5. Select Save.

Microsoft 365 has a set of security features that can help protect your business and to make it easier for you to turn them on we've packaged them as a set that you can turn on together.

1. Go to the Microsoft 365 Defender portal (https://security.microsoft.com) and sign in.

2. Under Email & Collaboration go to Policies & Rules > Threat policies > Preset Security Policies in the Templated policies section.

3. On the Preset security policies page, in the Standard card, select Manage protection settings.
   
   

4. The Apply standard protection wizard starts in a flyout. On the Exchange Online Protection page select All recipients. You want these protections to apply to everyone in your business. Then select Next.
   
   

5. Leave the setting to Turn on the policy after I finish so that the settings will take effect right away and select Next.

6. Review your settings and select Confirm to finish.