Microsoft 365 is only as secure as its settings. Business Premium includes the tools to cover much of the Essential Eight, but most of them are switched off by default. Start with three checks: MFA is enforced for everyone, everyone is on the same licence, and you have a protected emergency admin account. Then work through the Essential Eight gaps. A few of them need specialist setup, and backups need a separate product.
Is Your Microsoft 365 Actually Secure? A Plain-English Checklist for Perth Businesses
Most Perth businesses already pay for strong security in Microsoft 365 and never switch it on. Three checks an owner can do today, how Business Premium lines up against the Essential Eight, and the places businesses usually get stuck.
Is your Microsoft 365 actually secure?
Microsoft 365 is only as secure as its settings. Business Premium includes the tools to cover much of the Essential Eight, but most of them are switched off by default. Start with three checks: MFA is enforced for everyone, everyone is on the same licence, and you have a protected emergency admin account. Then work through the Essential Eight gaps. A few of them need specialist setup, and backups need a separate product.
StartCloud's verdict: Start with the three owner checks, then work through the Essential Eight gaps with help where you need it.
Paying for protection you have not switched on
Microsoft 365 Business Premium comes with serious security tools: device management, endpoint protection, email filtering and sign-in controls. The catch is that buying the licence does not turn them on. When we look at a new client's Microsoft 365, the most common finding is not a missing product. It is settings nobody configured, staff on a mix of licences, and an admin account protected by nothing more than a password.
The good news is that the fixes are usually quick, and you have already paid for the tools.
Three checks an owner can do today
You do not need to be technical for these. Ask your IT person or provider, or check the admin centre yourself.
Check 1: Is MFA enforced for everyone, every time?
Ask: "Is MFA enforced through Conditional Access or security defaults, and is anyone excluded?" Good looks like every account covered, the only exclusion being your emergency admin account, and older sign-in methods (legacy authentication) blocked, because they skip MFA entirely.
Work through our Conditional Access module and MFA module, or read MFA and business email compromise.
Check 2: Is everyone on the same licence?
In the Microsoft 365 admin centre, look under Billing, then Licences. If some staff are on Business Standard or Basic and others on Premium, your security policies have gaps, because the tools only protect people who are licensed for them. Some businesses also find staff holding both a Standard and a Premium licence, which means paying twice.
Check 3: Do you have an emergency admin account, and is it protected?
An emergency (or "break glass") account gets you back in if a setting locks everyone out. Good looks like two emergency accounts, each protected with a physical security key stored somewhere safe, and an alert whenever either one signs in. Microsoft now requires MFA to sign in to its admin portals, so an emergency account set up without MFA may not get you in when you need it most.
Our protect admin accounts module covers the setup.
How Business Premium lines up against the Essential Eight
| Essential Eight strategy | What Business Premium gives you | DIY or get help |
|---|---|---|
| Multi-factor authentication | Conditional Access policies in Entra ID | DIY if you are careful, with an emergency account set up first |
| Restrict administrative privileges | Separate admin accounts, Windows LAPS through Intune (no just-in-time admin access, which needs Entra ID P2) | Get help |
| Patch operating systems | Windows Update rings and update policies in Intune | DIY once it is set up |
| Patch applications | Updates for Microsoft 365 Apps and Edge (third-party apps need extra tooling) | Get help |
| Configure Microsoft Office macro settings | Block macros from the internet through Intune policy | Get help |
| User application hardening | Attack surface reduction rules in Defender for Business | Get help |
| Application control | App Control for Business, deployed through Intune | Get help, and plan for testing time |
| Regular backups | Not included. OneDrive and retention are not a backup | Get help |
For most small businesses, Maturity Level 1 is realistic on Business Premium. Levels 2 and 3 take more tuning, more testing and evidence that the controls work. Read about the Essential Eight and work through our Essential Eight checklist.
Five quick wins most guides miss
- Turn on the Standard preset security policy. Defender for Office 365 is included in Business Premium, and the preset policy switches on anti-phishing, Safe Links and Safe Attachments in one step. See our preset security policies module.
- Set up SPF, DKIM and DMARC for your domain. They make it much harder for criminals to send email pretending to be you. Work through our stop email spoofing module.
- Stop staff approving third-party apps on their own. "Consent phishing" tricks people into granting a fake app access to their mailbox, and it works even with MFA in place. Require an admin to approve new apps. Read Shadow AI at work.
- Block automatic forwarding of email to outside addresses. It is a favourite trick after an account is compromised, because it quietly copies every email to the attacker.
- Give admins a separate admin account. Everyday email and browsing should never happen on an account that can change your security settings.
Where businesses usually get stuck
- Locking themselves out. A Conditional Access policy with no emergency account excluded can lock out every admin at once.
- Devices falling out of compliance. A laptop that has been switched off over a holiday can be marked non-compliant and blocked until it catches up, which can take a day.
- Macs, phones and personal devices. Each needs its own policies, and personal phones need a lighter touch that protects company data without managing the whole device.
- Backups nobody has tested. OneDrive syncs deletions and encrypted files too. Read business continuity and disaster recovery and our backups module.
- Settings drifting. New staff, new apps and Microsoft's own changes mean a tenant that was set up well two years ago may not be now. Someone needs to review it regularly.
If clients, insurers or tenders are asking
Cyber insurers, larger clients and government tenders increasingly ask about MFA, backups, endpoint protection and the Essential Eight. Many of the answers come straight from how your Microsoft 365 is configured, so working through this checklist also prepares you for those questionnaires. Read what cyber insurance covers and what insurers require.
Get a free Microsoft 365 security check
Not sure how your settings stack up? We will review your Microsoft 365 with you and give you a one-page report covering:
- Whether MFA and Conditional Access are actually protecting everyone
- Your licence mix, including any licences you are paying for twice
- Your Microsoft Secure Score and the quick wins behind it
- Backup status
- An Essential Eight gap snapshot
It takes a 30-minute call. We look with read-only access, which is removed straight afterwards. No obligation.
Book your free security checkMicrosoft 365 security checklist: the questions we get asked
Is Microsoft 365 secure out of the box?
Not fully. Security defaults give you basic MFA, but most of the protection in Business Premium, such as device management, endpoint protection and email filtering policies, has to be configured before it does anything.
Do I need Business Premium, or is Business Standard enough?
Business Standard does not include Conditional Access, Intune device management, Defender for Business or Defender for Office 365. For a business that wants to meet the Essential Eight, Business Premium is usually the cheapest credible starting point.
Does Business Premium make us Essential Eight compliant?
No licence makes you compliant on its own. Configured well, Business Premium covers much of Maturity Level 1. Backups and patching of non-Microsoft apps need extra tools, and every control needs evidence that it works.
Can we do this ourselves?
The three owner checks, yes. Conditional Access, Intune and application control are best done with help, because a mistake can lock everyone out or stop staff working.
Is OneDrive a backup?
No. OneDrive keeps files in sync, which means deletions and ransomware-encrypted files sync too. Retention settings help, but a separate backup is still needed to meet the Essential Eight.
What does the free security check involve?
A 30-minute call and a one-page report. We review your settings with read-only access, remove that access straight afterwards, and tell you what to fix first. There is no obligation to use us for the fixes.
References
- Australian Signals Directorate: Essential Eight
- Microsoft Learn: Manage emergency access admin accounts
- Microsoft Learn: Mandatory MFA for Azure and admin portals
- Microsoft Learn: Preset security policies in Defender for Office 365
- Microsoft Learn: Resources for Microsoft partners working with small and medium-sized businesses
Prepared October 2026 by StartCloud (Start Technologies Pty Ltd). Microsoft features and licensing change often, so confirm details before making purchase decisions.