Microsoft 365 security setup: switch on what you already pay for
Most Microsoft 365 plans include security that is never switched on. We identify your plan, switch on multi-factor sign-in, the right sign-in rules, device management, email protection and data labels, then prove each one works. Where Microsoft is weak for a small business, we add what is missing.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Regulators“Were reasonable security arrangements in place for email?”Multi-factor sign-in, phishing filtering and Conditional Access support the s24 Protection Obligation.Singapore Statutes Online (PDPA), read 12 Oct 2026
- Insurers“Is multi-factor sign-in mandatory for remote access and admin accounts?”Insurer proposal forms ask both, so the setup answers them with evidence.MSIG Insurance (Singapore) Pte Ltd, read 12 Oct 2026
- Insurers“Do you filter email?”Insurer proposal forms ask whether an email filter is used on all accounts.MSIG Insurance (Singapore) Pte Ltd, read 12 Oct 2026
- Management“Isn’t Microsoft responsible for our security?”Microsoft says data, accounts and access management (multi-factor sign-in, Conditional Access) always remain the customer’s responsibility.Microsoft, read 12 Oct 2026
PDPC (26 Feb 2026) found a breach of the Protection Obligation after a ransomware attack affecting about 39,000 individuals. It cited unpatched systems, weak access controls and failure to enforce multi-factor sign-in.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What each Business plan includes for security
All three Business plans are for up to 300 users.
- Multi-factor sign-in through security defaults, on by default
- Built-in protection against spam, malware and spoofing for cloud mailboxes
- Safe Links checks on links at the time of click
- Basic Mobility and Security for phones
- No Conditional Access, no Intune, no Defender for Business, no data loss prevention
- Microsoft Entra ID P1, with Conditional Access sign-in rules
- Defender for Office 365 Plan 1: Safe Attachments, Safe Links and impersonation protection
- Defender for Business: ransomware and malware protection for devices
- Intune Plan 1 device management, and Windows LAPS through Intune
- Purview Information Protection and data loss prevention for email and files
- Eligibility for Windows Autopatch
Sources: Microsoft, Compare all Microsoft 365 business plans; Microsoft Learn, Microsoft 365 Business Premium security overview and security defaults; all read 12 October 2026.
What we switch on
- Multi-factor sign-in for every account, administrators first
- Conditional Access rules that block risky and legacy sign-ins (Premium)
- Intune device management, disk encryption and automatic updates (Premium)
- Defender for Business and Defender for Office 365 (Premium)
- Purview sensitivity labels and data loss prevention (Premium)
- Windows Autopatch and Windows LAPS for local administrator passwords (Premium)
What we add where Microsoft is weak
Under Microsoft’s shared responsibility model, your data, accounts and access stay your responsibility.
- A password vault for shared and administrator passwords
- Mobile management for mixed fleets of phones and laptops, with Scalefusion
- Immutable 3-2-1-1-0 backup of mail, OneDrive, SharePoint and Teams
Source: Microsoft Learn, Shared responsibility in the cloud, read 12 October 2026.
Common questions
Do we need Business Premium?
Not always. Basic and Standard include multi-factor sign-in through security defaults and built-in email filtering. Premium adds Conditional Access, Intune, Defender for Business and Purview data protection. We map what you have before you buy anything.
Does Microsoft back up our data?
Microsoft keeps the service running, but under its shared responsibility model your data, accounts and access stay your responsibility, and Microsoft sells backup as a separate service. We set up a backup you can restore.
Latest PDPC case on this topic · 2026-09-21 · Security and facilities services · Voluntary undertaking
Service accounts with VPN access need the same protection as staff logins: stolen credentials gave attackers file-server access to staff, ex-staff and contractor data.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)