Lock Down Email With Four Microsoft 365 Settings in Miami

Email is the most common entry point for phishing attempts, account takeovers, and malware delivery. Microsoft 365 ships with strong protective settings, but many of them are not on by default. If your South Florida business runs on 365 and you have not reviewed these four settings, it is worth an hour of your time this week.

1. Turn On Multi-Factor Authentication for Every Account

Multi-factor authentication (MFA) requires a second verification step — usually a code from an app on a phone — before anyone can sign in. If a password is stolen or guessed, MFA stops the attacker from getting in. In Microsoft 365, you enable MFA through the Microsoft 365 admin center under Users > Active users > Multi-factor authentication. Set it to required for all users, not just administrators. Use the Microsoft Authenticator app rather than SMS codes when possible, because app-based codes are harder to intercept.

2. Enable Anti-Phishing Policies in Defender for Office 365

Microsoft 365 Business Premium and higher plans include Microsoft Defender for Office 365, which contains anti-phishing policies. The default policy offers some protection, but reviewing and tightening it adds meaningful coverage. In the Microsoft 365 Defender portal, go to Email and Collaboration > Policies and Rules > Threat Policies > Anti-phishing. Check that impersonation protection is on for your domain and for key individuals like your owner or finance manager. Enable mailbox intelligence so the system learns normal sending patterns and flags unusual ones.

3. Configure Anti-Spoofing and SPF, DKIM, and DMARC Records

Spoofing means an attacker sends email that appears to come from your domain. Three DNS records work together to stop this: SPF lists the servers allowed to send mail for your domain, DKIM adds a digital signature to outgoing messages, and DMARC tells receiving servers what to do when a message fails those checks. You set SPF and DKIM inside Microsoft 365 and then publish the records through your domain registrar or DNS host. DMARC is a separate TXT record you add at the registrar. Start DMARC in monitoring mode (p=none) so you can review reports before moving to a stricter policy. Many Miami businesses skip these records entirely and remain easy targets for spoofed email.

4. Block Legacy Authentication Protocols

Older email protocols like POP3, IMAP, and SMTP AUTH do not support MFA. Attackers use these protocols specifically because they can bypass modern security controls. Unless you have a specific device or application that requires them, block legacy authentication in the Microsoft 365 admin center using Conditional Access policies or, at minimum, the Security Defaults setting. Go to Azure Active Directory > Properties > Manage Security Defaults and enable it if Conditional Access is not in your plan. This single change removes a significant category of sign-in attacks.

How to Work Through These Settings This Week

1. Sign in to the Microsoft 365 admin center and enable MFA for all users.
2. Open Defender portal and tighten your anti-phishing policy settings.
3. Check your DNS records and publish SPF, DKIM, and DMARC entries.
4. Block legacy authentication using Security Defaults or Conditional Access.
5. Review the MFA registration status report after 48 hours.

These four settings work together. MFA protects accounts if a password leaks. Anti-phishing policies catch deceptive messages before they reach inboxes. SPF, DKIM, and DMARC protect your domain's reputation and reduce spoofing. Blocking legacy authentication removes a backdoor that modern controls cannot cover. None of these require expensive add-ons — most are available in standard Microsoft 365 business plans. If you want a hand walking through the configuration or want IT MIAMI to review your current 365 setup, call us at (305) 900-2601 or book a free 15-minute call and we will get you sorted out quickly.