Home › Guides

Signs your Microsoft 365 tenant isn’t locked down

By Greg Mitchell · Squared Away Tech · October 11, 2026

Most small offices set up Microsoft 365 once, years ago, and it has worked well enough since. The email flows and Teams works. But “it works” and “it’s secure” are different things. Microsoft gives you strong security tools, but many of them have to be turned on and set up by someone.

Your “tenant” is simply your organization’s Microsoft 365 account: all your users, mailboxes, files and settings. Here are the warning signs I look for first when I review a small office’s tenant. If several of these sound familiar, it’s worth a closer look.

1. Not everyone gets a sign-in prompt on their phone

If some staff sign in with only a password, a single phished password is enough for an attacker to get in. Multi-factor authentication should cover every person, not just the owner.

2. People share a login

A shared front-desk account, or everyone knowing the password to info@, means you can’t tell who did what, and you can’t cut off one person without changing it for everyone. Shared mailboxes can be set up so each person uses their own sign-in.

3. You have more administrators than you can name

Global administrators can change anything. Over time, offices pile up admin accounts: the old IT provider, a former office manager, a vendor who set up the phones. Every one of those is a key to the whole building. Ask for a list. If you don’t recognize a name, that’s a problem.

4. Former employees still have accounts

When someone leaves, their account should be blocked the same day, their mail handled, and their license removed. If ex-employees can still sign in, or their mailboxes still forward to personal addresses, close that up.

5. Email can be forwarded outside without anyone knowing

Automatic forwarding to outside addresses is a favorite trick after a phishing attack. Unless there’s a real business reason, it should be blocked or tightly limited, and new forwarding rules should trigger an alert.

6. Older sign-in methods are still allowed

Some older email protocols can sign in with only a username and password, skipping multi-factor checks. Microsoft has been retiring many of these, but it’s still worth confirming that nothing in your tenant allows password-only sign-in.

7. Nobody reads the alerts

Microsoft 365 can warn you about risky sign-ins, unusual sending, and new forwarding rules. Those alerts often go to an administrator mailbox that nobody checks, or to someone who left two years ago. An alert nobody reads protects nobody.

8. Laptops aren’t managed or encrypted

If a laptop is stolen from a car in a parking lot, can you lock it or wipe it? Is the drive encrypted so the files can’t be read? If the answer is “I’m not sure,” your files may be one stolen laptop away from a data breach. Device management lets you require encryption, push updates and wipe a lost device remotely.

9. Files are shared with “anyone with the link”

Links that work for anyone are convenient, and they get forwarded, posted and forgotten. Check whether your OneDrive and SharePoint settings allow anonymous links, and whether old links ever expire.

10. Nothing is written down

If your IT person disappeared tomorrow, would anyone know how your Microsoft 365 is set up, who the administrators are, or where the emergency access account is? A short written record of your settings and changes is part of being secure. It also makes cyber-insurance questionnaires much easier to answer honestly.

What to do next

You don’t have to fix everything at once. A sensible order for most small offices:

1. Turn on multi-factor authentication for everyone and block older sign-in methods.
2. Clean up administrator accounts and former employees.
3. Block outside forwarding and make sure alerts go to someone who reads them.
4. Get laptops managed and encrypted.
5. Tighten file sharing and write it all down.

The safest way to start is with a read-only review that changes nothing and simply tells you where you stand. That’s exactly what my Security Checkup is. I’ve kept Microsoft 365 secure for a law firm, a county sheriff’s office, and a large multi-site organization, and I bring the same approach to small offices: changes made in stages, on evenings and weekends, with a written record of everything.

Squared Away Tech serves offices of 5 to 100 people in Ellenton, Bradenton, Sarasota and Tampa Bay, with remote service anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.