Microsoft 365 is the backbone of most Australian small businesses - email, files, Teams calls, shared calendars all live there. Microsoft now switches on more protection by default, but tenants are often not optimised: some controls are still off, and others need someone to check they cover every user.

You don’t need to be the one configuring this. But you do need to know enough to ask the right questions. Here are five specific things to raise with your IT provider on your next catch-up - and what a good answer sounds like.

1. Ask: Is MFA enforced for every user, including admins?

Multi-factor authentication (MFA) means a second step when signing in, on top of the password: usually typing a number from the sign-in screen into the Microsoft Authenticator app on your phone. Microsoft’s own research found it blocks over 99.9% of account compromise attacks. It’s free on every Microsoft 365 plan.

The risk is that MFA was either never turned on, or was switched off for a staff member who found it inconvenient. A good answer from your provider sounds like: "Yes, it’s enforced for all users including admins, and we’ve checked there are no exemptions."

2. Ask: Are old, insecure sign-in methods blocked?

Microsoft 365 used to support older sign-in methods (the technical term is "legacy authentication") that don’t work with MFA. Where one is still allowed, an attacker with a stolen password can bypass MFA by using it.

Microsoft switched most of these off in Exchange Online during 2022 and 2023. What remains is the exceptions: an old scanner or line-of-business app that still sends email with a plain username and password, and tenants where neither Security defaults nor a Conditional Access policy blocks legacy sign-ins. A good answer sounds like: "Legacy authentication is blocked, and we’ve checked the sign-in logs to confirm nothing legitimate still uses it."

3. Ask: Are Safe Links and Safe Attachments set to Microsoft’s recommended level for every user?

Microsoft 365 Business Premium includes a layer of email protection called Defender for Office 365. Two features matter most: Safe Links rewrites links in emails and checks them at the moment a staff member clicks - even if the link looked safe when the email first arrived. Safe Attachments opens email attachments in an isolated environment to check them for malware before they hit the inbox.

On Business Premium, Microsoft’s Built-in protection now gives every mailbox a basic level of Safe Links and Safe Attachments by default. Microsoft recommends going further with its Standard or Strict preset policies. Safe Attachments for SharePoint, OneDrive and Teams is a separate switch that someone has to turn on. If you’re on Business Standard, you don’t have Defender for Office 365 unless it’s been added, so ask whether upgrading makes sense. A good answer sounds like: "Every user is on the Standard preset, nobody is excluded, and Safe Attachments for SharePoint, OneDrive and Teams is on."

4. Ask: Do external emails show a clear "external sender" warning?

A simple banner at the top of any email from outside your organisation is a cheap defence against phishing and impersonation. When a staff member gets an email that looks like it’s from a colleague but is actually from an attacker spoofing your domain, that warning is often the only thing that makes them pause.

This is a 15-minute configuration job for your IT provider and costs nothing extra.

5. Ask: Do we have a separate backup of our OneDrive and SharePoint data?

This is the question most owners think has an obvious answer. Microsoft 365 has redundancy: if a server fails at Microsoft’s end, your data is safe. But Microsoft is explicit that it is not a backup. If a staff member (or an attacker with their credentials) deletes a folder, or ransomware encrypts files synced through OneDrive, Microsoft’s recycle bins and version history only protect you for a limited window - typically 30 to 93 days, depending on the setting.

A proper cloud-to-cloud backup keeps an independent copy of your Microsoft 365 data (Exchange mail, OneDrive, SharePoint, Teams) with a third-party provider, on a longer retention schedule. A good answer from your IT provider sounds like: "Yes, we run a daily cloud-to-cloud backup of your M365 data with at least 12 months retention, and we’ve confirmed we can restore from it."

Where to go from here

These five questions won’t make you a cybersecurity expert, but they’ll quickly tell you whether your current IT provider is on top of the basics - or whether you’ve been paying for a helpdesk while gaps quietly opened up. For a deeper look at how to protect your business, see our cybersecurity and managed IT pages.

If your provider can’t give you clear answers to all five, it’s worth having a managed IT provider do an independent review.