Most small businesses set up Microsoft 365 once.
Someone creates the accounts, connects the domain, gets email flowing, and moves on. That makes sense. There is a business to run.
But Microsoft 365 is not just email. It holds your files, your conversations, your calendars, and often your customer information. The settings chosen on day one rarely match how the business works a few years later.
Here are the areas worth revisiting.
Multi-Factor Authentication for Everyone
If there is one setting to check first, it is this one.
Multi-factor authentication (MFA) means a stolen password is not enough to get into an account. Every user should have it, not just the owner or the office manager.
For many small businesses, Microsoft's security defaults in Microsoft Entra ID are a reasonable starting point. They require MFA registration and block older sign-in methods that are commonly abused. Businesses on plans that include Conditional Access can build more tailored rules, such as requiring MFA only from outside the office or blocking sign-ins from unexpected countries.
Who Has Admin Access
Over time, admin rights tend to spread. A former employee, an old vendor, or a day-to-day user account may still hold Global Administrator access.
A healthier setup looks like this:
- Only a small number of Global Administrators — Microsoft's own guidance is fewer than five
- Admins use a separate admin account, not the account they read email with
- Narrower roles (like User Administrator or Billing Administrator) where full admin is not needed
- No admin access left behind for people or vendors who no longer need it
External Sharing in SharePoint and OneDrive
SharePoint and OneDrive make sharing easy. That is the point.
But it is worth knowing whether your organization allows “anyone with the link” sharing, which lets files be opened by people who never sign in. For some businesses that is fine. For a business handling client records, contracts, or financial information, it may not be.
Sharing settings can be tightened at the organization level and then adjusted per site where a team genuinely needs more flexibility.
Mailbox Forwarding Rules
One of the most common signs of a compromised email account is a quiet inbox rule that forwards messages to an outside address, or moves certain emails out of sight.
Reviewing forwarding and inbox rules periodically is a simple habit. So is making sure automatic forwarding to external addresses is only allowed where there is a real business reason.
Licenses You Are Still Paying For
When people leave, their licenses often stay assigned. Small businesses can end up paying every month for accounts nobody uses.
A departed employee's mailbox can usually be converted to a shared mailbox, which keeps the email accessible to the right people without a license in most cases. Then the license can be removed or reassigned.
Audit Logs and Alerts
When something goes wrong, the first question is usually “what happened, and when?”
Microsoft 365 keeps audit records of sign-ins and activity, and it can send alerts for suspicious events. It is worth confirming audit logging is on and that alerts go to someone who will actually read them — not a shared inbox nobody checks.
A Review, Not a Rebuild
None of this requires starting over.
A focused review of identity, admin access, sharing, and licensing usually turns up a short list of practical fixes. Most of them do not change how people work day to day. They just close the gaps that grew while everyone was busy.
How Sentz Technology Helps
Sentz Technology provides Managed IT & Microsoft 365 support for small businesses that do not have an internal IT department — reviewing configuration, tightening security, handling onboarding and offboarding, and keeping the environment tidy over time.
And because the same work often touches workflows and integrations, Microsoft 365 improvements can connect directly to automation and systems integration projects.