Account takeover means someone else is signing in as one of your employees. In Microsoft 365 that gives them the mailbox, the OneDrive, the Teams chats, and the trust of every client who has ever received an email from that person. It is how most invoice fraud starts, and it rarely involves anything clever. A password is phished, guessed, or bought, and the attacker logs in.
The good news is that Microsoft 365 already contains the controls that stop most of it. Microsoft says that requiring multifactor authentication and blocking legacy authentication stop more than 99.9 percent of common identity attacks. The trouble is that the controls are spread across four admin centers, some are off by default, and some depend on your license. Below are the settings that matter most for account takeover prevention, in the order we would fix them, with license notes where they apply.
Start with multifactor sign in for every account, and choose the stronger kinds
Every user, every administrator, every shared mailbox that someone signs in to directly. No exceptions for the owner, the bookkeeper, or the person who travels a lot. Passwords leak in ways you never see, including infostealer malware on a home computer, so a second factor is the minimum.
The method matters. Microsoft now uses number matching for all Authenticator push notifications, so a user has to type the number shown on the sign in screen instead of tapping approve. That ends the old trick of flooding someone with prompts until they accept one. Text messages and phone calls are weaker and should be a fallback, not the plan. For administrators and anyone who moves money, go further. Microsoft's built in phishing resistant MFA strength accepts only Windows Hello for Business or a platform credential, FIDO2 security keys and passkeys, and certificate based authentication, because those methods are tied to the real sign in page and cannot be relayed through a fake one. Our guide to phishing resistant MFA covers the rollout.
Security defaults or Conditional Access: pick one on purpose
Every tenant has one of two foundations, and many small businesses do not know which. Security defaults are free and simple. They require all users to register for MFA, require MFA for administrators every time, prompt users when Microsoft judges it necessary, block legacy authentication, block device code flow, and protect the Azure portal. Microsoft removed the old 14 day registration grace period in July 2024. The tradeoff is that security defaults are all or nothing, with no exceptions and no tuning.
Conditional Access is the customizable version and requires Microsoft Entra ID P1. Microsoft's licensing page confirms P1 is included in Microsoft 365 Business Premium as well as E3 and E5; our comparison of Business Premium vs E3 vs E5 explains the rest. You cannot run both at once. If you turn off security defaults, replace them the same day with Conditional Access policies that cover MFA for all users, MFA for admins, and legacy authentication. Microsoft also recommends two cloud only emergency access accounts, excluded from these policies and stored safely, so a misconfiguration cannot lock everyone out.
Block legacy authentication, the side door MFA cannot cover
Legacy authentication means older protocols such as IMAP, POP3, and authenticated SMTP, and old clients such as Office 2010. None of them can perform MFA, so an attacker with a password can use them to walk around your MFA policy. Microsoft's guidance on blocking legacy authentication reports that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use these protocols.
Before blocking, check the sign in logs and filter by client app to find what still depends on old protocols. The usual culprits are a copier that scans to email, a line of business app that sends alerts, or one person's ancient phone mail app. Fix those, create the block policy in report only mode, watch it for a week, then switch it on.
Clean up admin roles before an attacker finds them
A taken over Global Administrator is a taken over company. Microsoft recommends assigning Global Administrator to fewer than five people and giving everyone else the narrowest role that does the job, such as Exchange Administrator or Helpdesk Administrator. Admin work should happen from a separate admin account, not the account that reads email all day. Just in time elevation through Privileged Identity Management requires Entra ID P2 or ID Governance, but even without it, a quarterly review of who holds which role catches most problems. Our article on privileged access management goes deeper.
Shut off silent mail forwarding and get alerted when rules appear
Once inside a mailbox, attackers often create inbox rules that forward copies of mail outside the company or hide replies from the real user. That is the backbone of business email compromise. In the Defender portal, the outbound spam policy controls automatic external forwarding. Microsoft's forwarding documentation says the default "Automatic" setting can behave differently between organizations, so set it explicitly to Off, and create a separate policy for the rare mailbox that truly needs to forward.
Then make sure someone hears about new rules. Microsoft provides default alert policies named "Suspicious email forwarding activity" and "Creation of forwarding/redirect rule," and the auto forwarded messages report shows who is forwarding today. Note that the rule creation alert only tracks rules made in Outlook on the web or through PowerShell, and Microsoft ties alert availability to specific plans, so confirm the alerts exist in your tenant and route them to a person who reads them.
Add sign in risk and user risk policies if your license includes them
Microsoft Entra ID Protection scores each sign in and each user for signs of compromise, such as leaked credentials, impossible travel, or unfamiliar sign in properties. Risk based policies can then require MFA when sign in risk is medium or high, and require a secure password change or risk remediation when a user is flagged. These policies need Entra ID P2, which comes with Microsoft 365 E5 or, for smaller businesses, the Defender add on suites for Business Premium.
One date matters right now. The older risk policies configured directly inside ID Protection were retired on October 1, 2026. If your tenant relied on them, confirm they were rebuilt as Conditional Access policies, or you may have lost that protection without noticing.
Stop users from granting mailbox access to unknown apps
Not every takeover needs a password. By default, users can consent to apps that ask for permissions not requiring an administrator, including an app that reads their own mailbox. A convincing "connect your calendar" prompt can hand an attacker ongoing access that survives a password reset. Microsoft recommends allowing user consent only for apps from verified publishers, and only for low impact permissions you choose. Turn on the admin consent workflow so people can request anything else, and review the apps already granted, because changing the setting does not remove past consents. This belongs with the rest of your access control decisions.
Turn on audit logging, because it may not be on
This one surprises people. Microsoft's audit documentation states that auditing is not enabled by default for Business Basic, Business Standard, and Business Premium, and must be turned on manually in the Microsoft Purview portal. Once on, standard auditing keeps activity for 180 days. Without it, after a takeover you cannot answer which emails were read, which files were downloaded, or which rules were created, and those answers often decide whether you can show that nothing sensitive left the building. For a broader checklist beyond takeover, see our guide to Microsoft 365 security settings.
How GlobeVM helps
GlobeVM has managed technology for Los Angeles businesses for 30 years and supports more than 75 organizations across Southern California. MFA, email filtering, endpoint protection, and firewall management are standard in every plan. Through our managed Office 365 services, we work through this list in your tenant, test each change in report only mode first, and keep watching sign ins 24/7 after it is done. When something looks off, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
Want a quick outside view first? Run our free email security check on your domain.
Then call (818) 405-9930 or book a free IT assessment.