Microsoft 365 Security in 2026: The Complete Hardening Guide for Small Vietnamese Businesses

Microsoft 365 Business Premium contains world-class security tools — but they ship disabled by default. Most small businesses are paying for protection they've never turned on.

Why Microsoft 365 Is the #1 Attack Target

Over 70% of Vietnamese SMBs now use Microsoft 365 for email, documents, and collaboration. Cybercriminals know this. Attacks targeting Microsoft 365 accounts increased 156% between 2023 and 2025, with small businesses accounting for the majority of victims.

Why? Because most M365 deployments are configured exactly as Microsoft delivers them — optimized for ease of setup, not security. Default M365 settings allow:

Logins from any country, any device, with just a password
Automatic email forwarding to external addresses
File sharing with "anyone with a link" — no sign-in required
Legacy email protocols (IMAP/POP3) that bypass modern security controls
No audit logging of admin actions

If you bought Microsoft 365 and configured it yourself, or had a reseller set it up quickly, most of these vulnerabilities are probably still open.

Your Microsoft 365 Security Score: Where Are You?

Microsoft provides a free Secure Score tool at security.microsoft.com that rates your tenant's security configuration from 0 to 100.

Average Secure Score for Vietnamese SMBs we audit: 28–35 out of 100.

A score below 40 means critical protections are disabled. Our target for clients: above 65 within 90 days.

The 12 Microsoft 365 Security Settings Every Small Business Must Configure

1. Enable MFA for All Users

The single highest-impact change. Enable via Security Defaults (free) or Conditional Access (M365 Business Premium).

Action: Admin Center → Azure Active Directory → Properties → Manage Security Defaults → Enable

2. Block Legacy Authentication

POP3, IMAP, and Basic Authentication bypass MFA entirely. If these protocols are enabled, MFA means nothing.

Action: Create a Conditional Access policy: "Block legacy authentication" → Apply to All Users

3. Configure Anti-Phishing Policies

Microsoft Defender for Office 365 includes anti-phishing AI that detects impersonation, spoofing, and lookalike domains. The default policy exists but is not configured for maximum protection.

Key settings to enable:

Enable impersonation protection (protect your domain and key users)
Enable spoof intelligence
Set first contact safety tips
Configure mailbox intelligence protection

4. Enable Safe Links

Safe Links rewrites every URL in emails and documents, checking them against Microsoft's threat intelligence database at click time. Links to malicious sites are blocked even if they were clean when delivered.

Action: Microsoft 365 Defender → Policies → Safe Links → Create/Edit policy → Apply to all users

5. Enable Safe Attachments

Attachments are detonated in a sandboxed environment before delivery. If they contain malware, they're blocked. This catches zero-day malware before signatures exist for it.

Action: Microsoft 365 Defender → Policies → Safe Attachments → Enable for all users

6. Disable External Email Forwarding

After compromising an email account, attackers almost always set up a forwarding rule to silently receive copies of all emails. Your staff won't notice; the attacker reads everything for months.

Action: Exchange Admin Center → Mail Flow → Remote Domains → Outbound Spam Policy → Disable automatic external forwarding

7. Enable Audit Logging

Without audit logs, you cannot investigate security incidents. M365 audit logging captures every admin action, email send, file access, and login — but it's disabled by default in some plans.

Action: Compliance Portal → Audit → Turn on auditing

8. Configure Alert Policies

Set up automated alerts for:

Unusual sign-in activity (impossible travel, new device)
Mail forwarding rules created
Mass file downloads
Admin permission changes

Action: Compliance Portal → Alert Policies → Configure high-risk alerts

9. Review and Restrict Guest Access

If you use Microsoft Teams, guests from external organizations may have access to channels, files, and conversations. Audit who has guest access and remove anyone who no longer needs it.

Action: Teams Admin Center → Org-wide settings → Guest access → Configure restrictions

10. Enable Information Protection Labels

For businesses handling customer data, contracts, or financial information, sensitivity labels prevent accidental external sharing of confidential documents.

Action: Microsoft Purview → Information Protection → Labels → Create labels and auto-labeling policies

11. Disable Unused Microsoft 365 Features

Many M365 features are enabled but unused — each represents an attack surface. Review and disable:

Sway (if not used)
Forms external sharing
Power Automate external connectors you don't use

12. Implement Microsoft Entra ID Protection

Part of M365 Business Premium, Entra ID Protection uses machine learning to detect risky sign-ins and compromised accounts in real time, automatically requiring step-up authentication or blocking access.

Action: Microsoft Entra → Protection → Identity Protection → Configure risk policies

Microsoft 365 Plans: What Security Features You Have

Feature	Business Basic	Business Standard	Business Premium
MFA	✓	✓	✓
Conditional Access	Limited	Limited	Full
Defender for Office 365 (Safe Links/Attachments)	✗	✗	✓
Intune Device Management	✗	✗	✓
Azure AD P1 (Conditional Access)	✗	✗	✓
Azure AD P2 (Identity Protection)	✗	✗	✓
Microsoft Defender for Business	✗	✗	✓

For any business with 10+ users handling business data: Microsoft 365 Business Premium is the minimum viable plan for security. The additional cost (~200K VND/user/month over Business Standard) includes security tools worth far more if you purchased them separately.

How Vietify IT Secures Your Microsoft 365 Tenant

Our M365 Security Hardening Service:

Service	What We Do
Security Audit	Full review of your current M365 Secure Score and configuration
Baseline Hardening	All 12 settings above configured within 5 business days
Conditional Access Design	Policies tailored to your business's access patterns
Defender for Office 365 Configuration	Anti-phishing, Safe Links, and Safe Attachments tuned and tested
Alert Policy Setup	Custom alerts for your most critical risks
Monthly Secure Score Review	Track progress and catch new vulnerabilities as Microsoft rolls out updates

Typical Secure Score improvement: from 28 to 68+ within 30 days.

Your Microsoft 365 Subscription Includes the Solution

Most small businesses are already paying for the security tools they need — they just haven't been turned on.

Book a free Microsoft 365 Security Audit with Vietify IT. We'll run your Secure Score, identify the top 5 risks in your current configuration, and show you exactly what needs to be fixed — in a 45-minute session.

Call: 0914 985 772 | vietify.vn/contact

Vietify IT Services — Da Nang's Microsoft 365 Security Specialists. Making your M365 investment actually protect you.