October 30, 2026 Best Practices 7 min read

Microsoft 365 Security for Canadian Small Businesses

By Omer Segoly, CISM | Published October 30, 2026

Microsoft 365 Security Defaults is free on all Microsoft 365 plans, and Microsoft says the protections it enables (MFA and blocking legacy authentication) stop more than 99.9% of common identity-related attacks. For Canadian small businesses using Microsoft 365, enabling Security Defaults and configuring the settings below addresses several CCCS Baseline Controls, including authentication (BC.5), cloud security (BC.10), and access control (BC.12). This guide covers the settings that matter most. This is informational context (not legal advice).

What Is the Single Most Important Microsoft 365 Security Setting?

Enable Security Defaults in Microsoft Entra ID. According to Microsoft's Security Defaults documentation, "more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication." Security Defaults is free on all Microsoft 365 plans and provides:

• Requiring all users to register for multifactor authentication
• Requiring administrators to do multifactor authentication
• Requiring users to do multifactor authentication when necessary
• Blocking legacy authentication protocols
• Blocking device code flow (as of July 1, 2026 for new tenants)
• Protecting privileged activities like access to the Azure portal

Microsoft states that Security Defaults are being rolled out to all new tenants at creation. If your tenant was created before October 22, 2019, enable it manually in the Microsoft Entra admin centre under Entra ID, Overview, Properties, Manage security defaults.

This addresses CCCS Baseline Control BC.5, which recommends implementing two-factor authentication wherever possible. The Canadian Centre for Cyber Security's guidance on cloud and outsourced IT services recommends ensuring that "administrative accounts for cloud services use two-factor authentication."

Why Does Blocking Legacy Authentication Matter?

Legacy authentication protocols cannot support multi-factor authentication. Microsoft defines legacy authentication as "an authentication request made by clients that don't use modern authentication (for example, an Office 2010 client)" and "any client that uses older mail protocols such as IMAP, SMTP, or POP3."

According to Microsoft, "most compromising sign-in attempts come from legacy authentication." An attacker who obtains credentials through phishing or a data breach can authenticate using an older protocol and bypass MFA entirely.

Security Defaults blocks legacy authentication automatically. Organizations on Business Premium or Enterprise plans can instead use Conditional Access policies for more granular control, but Security Defaults provides the baseline protection at no additional licence cost.

How Many Global Administrators Should a Small Business Have?

Minimize Global Administrator accounts to two or three. Microsoft's Security Defaults documentation recommends having "two cloud-only emergency access accounts permanently assigned the Global Administrator role" that are "not assigned to specific individuals" and are "limited to emergency or 'break glass' scenarios."

For regular administration, use dedicated admin accounts separate from daily-use accounts, require MFA on all admin accounts without exception, and review accounts quarterly. This aligns with CCCS Baseline Control BC.12.1, which states that "organizations should provision accounts with the minimum functionality necessary for tasks and, in particular, should restrict administrator privileges to an as-required basis."

Should Canadian Small Businesses Enable Audit Logging?

Yes. Microsoft states that "audit logging is on by default for Microsoft 365 organizations." However, the same documentation notes an important exception: "Auditing isn't enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium." Additionally, unmanaged tenants using free trials do not have auditing enabled by default.

If your organization uses an SMB licence, you must manually enable auditing in the Microsoft Purview portal. When enabled, the audit log records user and admin activity and retains it for 180 days by default. To verify your status, run the following command in Exchange Online PowerShell:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

A value of True indicates auditing is enabled. Audit logging supports CCCS Baseline Control BC.10 by providing visibility into how users interact with your cloud environment.

What External Sharing Settings Should Be Configured?

Review SharePoint and OneDrive sharing defaults. Microsoft 365 makes it easy to share files externally, but the default settings may be more permissive than your organization requires.

Key settings to review:

• Default link permissions: Ensure new sharing links default to "specific people" rather than "anyone with the link"
• External sharing in SharePoint: Determine whether users can share with people outside your organization
• Guest access in Teams: Review whether external guests can access your Teams channels
• Domain restrictions: If external sharing is enabled, consider restricting it to specific trusted domains

The CCCS guidance on cloud security recommends that organizations "evaluate how outsourced IT providers can handle and access your sensitive information." The same principle applies to external users who receive shared links to your data.

How Do You Detect Malicious Mailbox Forwarding Rules?

Attackers who compromise an email account often create forwarding rules to exfiltrate data or hide evidence of their activity. Microsoft's investigation of the Storm-2755 campaign targeting Canadian users documented attackers creating inbox rules to move messages containing keywords like "direct deposit" or "bank" out of sight.

Review mailbox forwarding rules regularly:

• Check for rules that forward email to external addresses
• Look for rules that delete or move messages matching finance keywords
• Audit rules that were created during unusual hours or from unusual locations

Our guide to token theft and AiTM phishing explains how these attacks work and why inbox rule alerting matters for Canadian businesses specifically targeted by this technique.

What Email Protection Does Microsoft 365 Include?

All Microsoft 365 cloud mailboxes receive built-in security features automatically: email with suspected malware is quarantined, high confidence phishing is quarantined by default, and anti-spam and anti-spoofing protection are on by default.

Microsoft 365 Business Premium includes Microsoft Defender for Office 365 (Plan 1), which adds Safe Attachments, Safe Links, and advanced anti-phishing policies. Organizations on Business Basic or Business Standard receive Exchange Online Protection (EOP), which provides baseline protections but not the advanced Defender features.

What Is Microsoft Secure Score?

Microsoft Secure Score is a measurement of your organization's security posture, available in the Microsoft Defender portal at no additional cost. If you enable Security Defaults, Microsoft states you receive full points for MFA (9 points), requiring MFA for admin roles (10 points), and blocking legacy authentication (7 points). Microsoft notes that "the recommendations don't cover all the attack surfaces associated with each product, but they're a good baseline."

What About Data Backup and Retention?

Microsoft maintains infrastructure backups for disaster recovery, but this does not protect against accidental deletion, malicious deletion by a compromised account, ransomware, or data loss from terminated employee accounts. Microsoft 365 includes retention policies with time limits. For critical business data, consider a third-party cloud-to-cloud backup solution. This aligns with CCCS Baseline Control BC.7, which states that organizations should "back up systems that contain essential business information."

For more on recovery scenarios, see our guide to backup and recovery.

How Does This Map to CCCS Baseline Controls?

The Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations includes 13 control areas. Microsoft 365 security settings address several:

• BC.5 (Authentication): Security Defaults enforces MFA for all users. The baseline recommends implementing "two-factor authentication wherever possible."
• BC.10 (Cloud Services): The CCCS cloud guidance recommends ensuring administrative accounts use two-factor authentication and evaluating how providers handle sensitive information.
• BC.12 (Access Control): BC.12.1 states that organizations should "provision accounts with the minimum functionality necessary for tasks." Limiting Global Administrators implements this control.
• BC.7 (Data Backup): BC.7.1 recommends backing up essential business information and ensuring recovery mechanisms work. Microsoft 365 data should be independently backed up.

CISA's Secure Cloud Business Applications (SCuBA) project provides additional secure configuration baselines for Microsoft 365, including the free ScubaGear assessment tool that evaluates tenant configuration.

One Question to Ask Your IT Provider

"Are Security Defaults enabled in our Microsoft 365 tenant, and when was our last audit log review?"

If your IT lead or managed service provider cannot answer this question, that conversation is where your Microsoft 365 security review should start.

Assess Your Microsoft 365 Security Posture

Our free cybersecurity assessment evaluates your organization against the Canadian Centre for Cyber Security's 13 Baseline Control areas, including authentication (BC.5), cloud security (BC.10), and access control (BC.12). The assessment covers 50 questions, takes under 30 minutes, and your answers stay in your browser. Progress is saved locally for 48 hours.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Microsoft 365 Security for Canadian Small Businesses. Retrieved from https://cybersecuritycanada.ca/news/posts/microsoft-365-security-for-small-business-canada/

Permanent URL: https://cybersecuritycanada.ca/news/posts/microsoft-365-security-for-small-business-canada/ · Published October 30, 2026