Microsoft 365 is the backbone of most small and mid-sized businesses in the UAE: email, Teams, SharePoint and OneDrive all live there. That also makes it the first target for attackers. Compromised mailboxes are a common starting point for invoice fraud, data theft and ransomware, and most of these incidents could have been prevented with settings that are already included in your licence.
Use this checklist to review your own tenant, or ask your IT provider to confirm each item is in place.
1. Enforce multi-factor authentication for everyone
MFA is the single most effective control against stolen passwords. Enable it for every user, with no exceptions for directors or shared mailboxes that people sign in to. Prefer the Microsoft Authenticator app with number matching, or passkeys, over SMS codes, and make sure all administrator accounts use MFA.
2. Use Conditional Access, not just Security Defaults
Security Defaults are a good free baseline. If you have Microsoft 365 Business Premium or Microsoft Entra ID P1, Conditional Access lets you go further: require MFA based on risk, block sign-ins from countries where you do not operate, and allow access to company data only from managed or compliant devices.
3. Separate and protect admin accounts
Global administrators should use dedicated admin accounts that are not used for day-to-day email. Keep the number of global admins small, use more limited admin roles where possible, and keep a securely stored break-glass account in case of lockout.
4. Block legacy authentication
Older protocols that do not support MFA give attackers a way around it. Make sure legacy authentication is blocked across the tenant and that old devices or scanners sending email are moved to a secure method.
5. Strengthen email protection
Configure anti-phishing, anti-spam and anti-malware policies, and use Microsoft Defender for Office 365 (included in Business Premium) for Safe Links and Safe Attachments. Publish SPF, DKIM and DMARC records for your domains so others cannot easily spoof your email address, and move DMARC towards an enforcing policy once reports look clean.
6. Watch for forwarding rules and suspicious sign-ins
Attackers who get into a mailbox often create rules that forward or hide messages so they can intercept invoices. Block automatic external forwarding by default, review alerts for suspicious inbox rules and impossible-travel sign-ins, and make sure someone actually reads those alerts.
7. Manage and secure devices
Use Microsoft Intune to enrol company laptops and phones, enforce encryption, screen locks and updates, and wipe company data from lost or departing staff devices. Pair this with modern endpoint protection and detection, such as Microsoft Defender for Business or a dedicated EDR product.
8. Control sharing in SharePoint and OneDrive
Review external sharing settings so that files cannot be shared with “anyone with the link” unless you genuinely need it. Set expiry dates on guest links, and use sensitivity labels for confidential documents.
9. Back up Microsoft 365 data
Microsoft keeps the service running, but protecting your data from accidental deletion, malicious insiders or ransomware is your responsibility. A third-party Microsoft 365 backup with long retention means you can restore mailboxes, files and Teams data when you need to.
10. Think about data protection and residency
The UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, along with free zone regimes such as DIFC and ADGM, sets expectations for how personal data is handled. Know where your Microsoft 365 data is stored, limit who can access personal data, and keep an audit trail.
11. Train your team
Technology catches most attacks, but not all. Short, regular phishing-awareness training and a clear process for verifying payment changes by phone stop many fraud attempts that reach the inbox.
12. Review regularly
Microsoft adds and changes security features frequently. Check your Microsoft Secure Score, review admin roles and licences, and revisit this checklist at least every quarter.
Need a hand?
Tech1UAE reviews and secures Microsoft 365 tenants for businesses across the UAE. Our cybersecurity team can assess your tenant against this checklist and fix the gaps, and our managed security services keep it monitored afterwards. Find out more about our cloud and Microsoft 365 services.
Need help with this? Tech1UAE supports businesses across all seven emirates with managed IT, cybersecurity and cloud services.
Talk to our team