It’s a reasonable assumption. You’re paying a monthly fee to one of the largest technology companies on earth. Surely they’ve handled the security part.
Microsoft secures their side of the arrangement — the data centers, the physical servers, the platform itself. What happens inside your tenant is your responsibility. Your user accounts, your permissions, your login rules, your data retention. Microsoft calls this the shared responsibility model, and it’s written into their documentation. The trouble is that almost nobody reads it.
At RJ PRO Tech Group, we’ve been managing Microsoft 365 environments for California businesses since 2010. When we take over a new client’s tenant, we run a full security review before anything else. In nearly every case, the same handful of settings are sitting wrong. Not because anyone was careless — because the defaults are built for convenience, and nobody told the business owner there was anything else to do.
Here are the seven we find most often, what each one actually protects you from, and how to check your own setup.
Why Microsoft 365 Has Become the Main Target
Email is where most business breaches start, and Microsoft 365 is where most business email lives.
An attacker who gets into one mailbox doesn’t just read messages. They watch. They learn how your company talks, who approves payments, which vendors you use, when your CFO travels. Then they send an invoice from an address your accounting team already trusts.
The numbers are worth sitting with. FBI figures put business email compromise losses well above ransomware, and the average incident costs far more than most small businesses assume. IBM’s latest breach research puts the global average cost of a data breach near $4.99 million, with stolen credentials among the most common entry points.
For a 20-person company in Sacramento or El Dorado Hills, the real figure looks more like a fraudulent wire transfer, three weeks of disruption, and some very uncomfortable phone calls to clients.
The frustrating part is that most of these attacks succeed through settings that were available the whole time. Turned off by default.
Setting 1: Multi-Factor Authentication on Every Account, Not Just Email
Most California businesses have MFA switched on somewhere. Very few have it everywhere.
The usual pattern goes like this. Someone enabled MFA for Outlook, everyone got used to approving a prompt on their phone, and the job was considered finished. Meanwhile the administrator accounts — the ones with the power to change every setting in the tenant — are still logging in with a password. So are the shared mailboxes. So is the account the accounting software uses.
Attackers look for exactly these gaps. They don’t attack the front door you reinforced. They check every other door.
A second problem hides underneath this one. Not all MFA is equal. SMS codes can be intercepted through SIM swapping. Simple approve-or-deny push notifications can be defeated by MFA fatigue attacks, where an attacker sends prompts repeatedly at 3 a.m. until someone taps approve just to make it stop.
What to check: every single account has MFA, including admins, service accounts, and anyone who left the company but whose account is still active. Number matching is turned on so users must type a code rather than just tap approve.
How RJ PRO handles it: we deploy MFA across the entire tenant, not just mailboxes, and configure the stronger authentication methods rather than the defaults. Our cybersecurity services include this as standard, along with the staff training that makes people understand why the extra step exists. If you want the fuller argument for it, we wrote about why multi-factor authentication is necessary in an earlier post.
Setting 2: Conditional Access Rules That Block Logins Before They Happen
MFA verifies who is logging in. Conditional Access decides whether that login should be allowed at all.
This is the setting we find missing most often in small business tenants, and it’s the one that would have prevented the most incidents we’ve cleaned up.
Think about your actual business. Your staff work from California. Maybe someone travels occasionally. Do you have any legitimate reason for an account to sign in from another continent at two in the morning? Almost certainly not. Conditional Access lets you say so, and Microsoft enforces it.
You can block sign-ins from countries where you don’t operate. You can require that devices be known and managed. You can force a fresh authentication when someone connects from an unfamiliar network. You can stop legacy authentication protocols, which are old and bypass MFA entirely.
That last point deserves emphasis. Legacy protocols like POP and IMAP were designed before modern security existed. If they’re still enabled in your tenant, an attacker can use them to skip past MFA completely. Many older tenants still have them switched on because turning them off might break an old device nobody wants to think about.
What to check: Conditional Access policies exist, legacy authentication is blocked, and sign-ins from outside your operating region are restricted.
How RJ PRO handles it: we build Conditional Access rules around how your business actually works — where your people are, what devices they use, what hours they keep. Configured badly, these rules lock out your own staff. Configured properly, they’re invisible to employees and brutal for attackers. This is part of our managed IT services rather than a one-time project, because the rules need adjusting as your team changes.
Not sure which of these are switched on in your tenant? We’ll check for you and tell you plainly what we find.
Setting 3: Audit Logging Turned On Before You Need It
Here’s a scenario we’ve walked into more than once.
A business suspects a mailbox was compromised. They want to know what the attacker saw, which messages were read, whether anything was forwarded, and how long it went on. Those answers determine whether they have a reportable breach on their hands.
Then we check the audit logs, and there aren’t any. Logging wasn’t enabled, or the retention period was too short, and the evidence simply doesn’t exist.
Without logs you cannot prove what happened. You also cannot prove what didn’t happen, which matters enormously if a client or a regulator asks. For California businesses handling personal information, that gap can turn a contained incident into a disclosure obligation.
What to check: unified audit logging is enabled, mailbox auditing is on for every mailbox, and your retention period matches your industry’s requirements rather than the default.
How RJ PRO handles it: we enable full audit logging during onboarding and set retention to match what your industry requires. For our clients in regulated fields — financial, medical, legal — that often means longer retention than the standard license provides, and we configure it accordingly.
Setting 4: Mailbox Forwarding Rules Nobody Is Watching
This is the quietest attack in the list, and one of the most damaging.
An attacker gets into a mailbox. Rather than doing anything dramatic, they create a rule that quietly forwards a copy of every incoming message to an outside address. Then they log out.
The employee notices nothing. Email works normally. Nothing looks wrong. Meanwhile the attacker reads months of correspondence, learns your payment processes, identifies your vendors, and waits for a large transaction to appear. Then they intervene with banking details of their own.
Some variations are cleverer still. Rules that move messages containing words like “invoice” or “wire” straight into a folder the user never checks, so they never see the real vendor asking why payment hasn’t arrived.
What to check: external auto-forwarding is blocked at the tenant level, and someone reviews new inbox rules regularly rather than never.
How RJ PRO handles it: we block automatic external forwarding by default and monitor for suspicious rule creation as part of our ongoing IT support services. When a rule appears that forwards mail outside the organization, we know within minutes instead of finding out months later.
Setting 5: Admin Accounts That Aren’t Used for Daily Work
In a lot of small California businesses, one person is the owner, the office manager, and the IT administrator. Their single account does everything — reads email, browses the web, and holds full control over the Microsoft 365 tenant.
That’s efficient. It’s also the single most dangerous account configuration you can have.
If that person clicks a bad link in a phishing email, the attacker doesn’t get a mailbox. They get your entire tenant. Every account, every file, every permission, and the ability to lock you out of your own business.
The fix is separation. Daily work happens in a normal account with normal permissions. Administrative work happens in a separate account used only for that purpose, protected with strong MFA, and not used for email or browsing.
The related principle is least privilege. Your receptionist doesn’t need access to payroll files. Your junior staff don’t need global admin rights that were granted three years ago during a project and never removed. Permissions accumulate quietly, and almost nobody audits them.
What to check: the number of global administrators in your tenant — it should be very small — and whether any of them are used for everyday email.
How RJ PRO handles it: we separate administrative accounts from daily-use accounts and review permissions on a schedule. Old accounts get disabled, unnecessary rights get removed, and access matches each person’s actual role.
Setting 6: Third-Party App Permissions You Never Reviewed
Over the years, your staff have connected things to Microsoft 365. A scheduling tool. A CRM integration. A document signing service. A free app someone tried once and forgot about.
Each of those connections was granted permissions. Some of them substantial — read your mail, access your files, sign in on your behalf. Those permissions don’t expire. They sit there indefinitely, and if the third-party service is ever compromised, that access becomes someone else’s doorway into your data.
Attackers have started exploiting this directly with consent phishing. Instead of stealing a password, they trick an employee into approving a malicious app. The employee never gives up credentials, MFA never triggers, and the attacker gets standing access that survives password changes.
What to check: which applications have permissions in your tenant, what each one can access, and whether users are allowed to grant consent themselves.
How RJ PRO handles it: we audit connected applications during our security review and restrict user consent so new apps require approval. Then we review the list periodically, because the problem rebuilds itself over time.
Setting 7: Backup, Because Microsoft Doesn’t Do It for You
This is the one that surprises people most, so it’s worth stating plainly.
Microsoft does not back up your data in the way you probably think they do.
Microsoft protects their infrastructure. They replicate data across data centers so a hardware failure doesn’t lose your information. That is not the same as a backup you can restore from.
If an employee deletes a folder and nobody notices for ninety days, it’s gone. If ransomware encrypts files that then sync to SharePoint, the encrypted versions sync too. If a departing employee wipes their mailbox on the way out, retention windows are shorter than most owners expect. If an attacker with admin access purges data deliberately, Microsoft’s replication faithfully replicates the deletion.
Microsoft’s own service agreement recommends regular backup through third-party services. It’s in the terms most people accept without reading.
For California businesses in regulated industries, this goes beyond inconvenience. If you’re required to retain records for a set number of years and your only copy lives in a system with a 30 to 90 day retention window, you have a compliance problem waiting to surface during an audit.
What to check: whether you have a genuine third-party backup of Microsoft 365, and whether anyone has ever tested restoring from it.
How RJ PRO handles it: we deploy proper Microsoft 365 backup with retention that matches your requirements, and we test restores rather than assuming they work. Our backup and disaster recovery service covers email, SharePoint, OneDrive, and Teams — because a backup nobody has tested is just an expensive assumption.
Worried your Microsoft 365 data isn’t actually backed up? Most businesses find out the hard way. You don’t have to.
What This Looks Like Across California
We support businesses across Calaveras, Amador, Sacramento, San Joaquin, and El Dorado counties, and the pattern holds everywhere. The Microsoft 365 tenant was set up years ago by whoever was available, it has worked fine, and nobody has looked at it since.
For businesses in El Dorado Hills and Folsom, we see a lot of professional services firms — financial advisors, law offices, medical practices — holding highly sensitive client data in tenants with default settings.
In Sacramento and Stockton, the mix tilts toward construction, manufacturing, and distribution, where the risk often sits in shared accounts and mobile devices connecting from job sites.
In Placerville, Cameron Park, and Valley Springs, the added complication is connectivity and fire season. When PG&E runs a Public Safety Power Shutoff, cloud-based systems keep a business running — but only if remote access was configured securely beforehand.
Different industries, same underlying gap.
Why California Businesses Choose RJ PRO Tech Group
There’s no shortage of IT companies who will sell you Microsoft 365 licenses. Far fewer will configure the security properly and keep it that way.
- 16+ years in Northern California. We’ve supported businesses here since 2010, across five counties. We know the region, the industries, and the specific pressures they face.
- 24/7/365 helpdesk. Attacks don’t wait for business hours. Neither do we.
- Flat-rate, predictable pricing. No per-incident charges and no surprise invoices when something breaks.
- Proactive, not reactive. Continuous monitoring catches problems in minutes. We prevent issues rather than billing you to clean them up.
- Our own technicians. When someone comes onsite, it’s our engineer who already knows your environment — not a subcontractor seeing it for the first time.
- A 100% satisfaction guarantee. We do what it takes to make it right.
You can see the full range of what we cover on our managed IT services page, the security side on our cybersecurity page, or the regions we cover on areas we service.
Frequently Asked Questions
We’re only twelve people. Are we really a target?
Yes, and often more so. Attackers favour smaller organisations precisely because the defences are thinner and the response slower. Most attacks are automated and don’t care about your headcount.
We have Microsoft 365 Business Premium. Doesn’t that cover it?
Business Premium includes strong security tools, and most businesses paying for it never switch them on. The licence gives you the capability. Somebody still has to configure it. We regularly find clients paying for features they’ve never used.
Can we check these settings ourselves?
Some of them, yes. The Microsoft 365 admin centre includes a Secure Score that gives you a starting picture. The difficulty is that changing these settings carelessly can lock out your own staff or break a workflow your business depends on, which is why most owners look once and leave it alone.
How long does it take to fix?
For a typical small business tenant, our security review takes a few days. Closing the significant gaps usually takes one to three weeks depending on what’s there. After that it becomes ongoing monitoring rather than a project.
We already have an IT provider. Can you just review the setup?
Yes. Many businesses bring us in for an independent review. We’ll tell you what we find plainly, whether or not you ever become a client.
Find Out What Your Tenant Actually Looks Like
Most businesses we assess are in better shape than they feared on some of these settings and worse on others. Reading an article won’t tell you which.
RJ PRO Tech Group will review your Microsoft 365 environment, identify exactly which of these gaps apply to you, and give you a straight answer about what needs fixing and in what order. No jargon, no scare tactics, no obligation.
Or call us directly — Valley Springs (209) 920-4077 or El Dorado Hills (916) 345-3451. You can also email help@rj-pro.net.
RJ PRO Tech Group — keeping California businesses secure, productive, and running since 2010.
