Microsoft 365 security
Microsoft 365 Security Checklist for Kingwood Small Offices
As of 08/2026, every small office should enforce MFA, block legacy authentication, review forwarding rules, separate admin accounts, and know how backups work before an account is compromised.
The checklist
| Setting | Risk if ignored | Action |
|---|---|---|
| MFA for all users | Stolen passwords become account access | Require MFA and document recovery methods |
| Admin separation | Daily-use accounts can become full tenant compromise | Use separate admin accounts and least privilege |
| Mailbox forwarding | Attackers silently copy mail or hide replies | Audit inbox rules, forwarding, aliases, and delegates |
| Legacy authentication | Older protocols can bypass modern controls | Block legacy auth unless a documented exception is required |
| Backups and retention | Deleted or encrypted cloud files may not be recoverable | Confirm retention, backup scope, and restore testing |
Signs a mailbox may already be compromised
Watch for unexpected MFA prompts, missing emails, strange sent messages, vendor payment changes, new forwarding rules, impossible-travel logins, and customers receiving emails no one remembers sending.
Where this connects to local support
KingsPark IT can help with Microsoft 365 email support, a small-business cybersecurity checkup, and ongoing managed IT services. Staff training should also include the phishing email checklist.
When to escalate
If ransomware, invoice fraud, customer data exposure, or multiple compromised accounts are suspected, stop normal cleanup and preserve evidence. For active malware or ransomware incidents, KingsPark IT can coordinate with Virus Pros.
Microsoft 365 security FAQs
What is the first Microsoft 365 security setting to check?
Start with MFA for every user, especially administrators, then review mailbox forwarding, legacy authentication, recovery methods, and admin account ownership.
Can a mailbox be compromised without a virus?
Yes. Many Microsoft 365 compromises happen through stolen passwords, weak MFA, malicious OAuth apps, or forwarding rules without malware on the computer.
When should a business escalate to incident response?
Escalate when invoices were changed, customers received suspicious emails, shared files were exposed, multiple accounts show strange sign-ins, or ransomware is suspected.
Want these settings checked?
Request a Microsoft 365 security review for your Kingwood office before email becomes the emergency.