Protect the identity before adding more security products
For most Microsoft 365 businesses, the highest-value first move is protecting accounts: enforce multi-factor authentication, reduce unnecessary admin access, and make suspicious email harder to act on. Then decide which devices can reach company data and how you would recover important content. “It is in the cloud” is not a complete security or backup plan.
Your mailbox is often the front door to the business
For many NZ SMEs, email and SharePoint/OneDrive are the business. Account takeover, invoice fraud, and accidental sharing can halt operations faster than a failed desktop. Security settings are only useful when someone owns them and reviews them as staff and suppliers change.
Five controls worth doing before anything fancy
If you only improve five things this quarter, make them these:
- MFA for all users—especially admins
- Reduce legacy authentication and risky sign-in paths
- Email filtering and anti-phishing protections
- Clear external sharing defaults for files and links
- Admin account hygiene and fewer standing privileged logins
Decide which devices are allowed through the door
Decide which devices may access mail and files, and what happens when a laptop is lost. Conditional access and device management options depend on your licences, but the business rule should be clear: company data should not sit unmanaged on unknown personal devices without a deliberate decision.
Recovery tools are not always a backup
Retention policies and recycle bins help, but they are not a full backup strategy. Confirm what would happen if ransomware, malicious deletion, or a bad sync wiped critical libraries—and whether your recovery objective matches that reality.
Buy licences for controls you will use
Some advanced controls need upgraded Microsoft licences; many essential improvements do not. Buy licence upgrades when a control is required—not because a dashboard looks impressive. A short security review usually clarifies what you already own versus what is worth adding.
Turn the tenant into a safer place to work
Inventory admin accounts, turn on MFA everywhere you can, review external sharing, and schedule a Microsoft 365 security review. If you are unsure where you stand, the Tier1 IT Health Check is a useful conversation starter before a deeper tenant review.
Frequently asked questions
Do we need special licences for security?
Some advanced features require upgraded licences, but many high-value controls—especially MFA discipline and sharing hygiene—are available or partially available on common plans. We map controls to what you already own first.
Is Microsoft 365 backed up by Microsoft automatically?
Microsoft provides service resilience and some recovery tools, but that is not the same as a business-defined backup and restore plan for malicious or accidental loss. Confirm your retention and backup approach explicitly.
What is the fastest win for most SMEs?
Enforcing MFA and cleaning up admin accounts usually reduces a large amount of account-takeover risk quickly.
Can you manage our Microsoft 365 tenant for us?
Yes. Tier1 can help with licensing, tenant hardening, user onboarding/offboarding, and ongoing administration as part of broader managed support.