Microsoft 365 Email Security
Best Practices for Aussie SMEs

If your Brisbane business runs Microsoft 365, every successful attack we see in 2026 still starts with email — phishing, business-email compromise, or invoice fraud. The good news is Microsoft 365 Business Premium ships with most of the controls you need. The bad news: about 70% of Brisbane SMEs we audit have those controls switched off, default-only, or completely misconfigured.

This guide walks every Microsoft 365 email security setting an Australian SME should enable, in priority order, with realistic local pricing.

Why M365 Email Is Still Target #1

The Australian Cyber Security Centre's most recent report (2024-25) shows business-email compromise as the top single cause of financial cyber loss for Aussie SMEs — averaging $50,000 per successful incident. Brisbane is no exception; we have helped Fortitude Valley agencies, CBD legal firms and Logan trades with BEC investigations in the past year.

Common attack patterns we see locally:

• Invoice redirection — attacker compromises one mailbox, watches invoices land, sends a 'changed bank details' email at the right moment
• Payroll diversion — fake email from 'the boss' asking HR to redirect a salary
• Microsoft 365 credential phishing — fake login page that captures credentials and bypasses weak MFA
• Attachment malware — Excel macro or HTML attachment that silently redirects or installs malware

Foundations: SPF, DKIM & DMARC

These three DNS records prove your email is genuinely from your domain. Without them, anyone in the world can spoof your address.

SPF (Sender Policy Framework)

Lists which servers are allowed to send mail from your domain. Set hard-fail (-all) once you are confident.

DKIM (DomainKeys Identified Mail)

Cryptographically signs each outgoing message. Microsoft 365 has DKIM available — you must enable it manually under Defender > Email & Collaboration > Policies.

DMARC

Tells receivers what to do if SPF or DKIM fail. Start with p=none and reporting, move to p=quarantine, then p=reject.

MFA & Conditional Access

1. Enable MFA for every user — number matching
   Microsoft Authenticator is the gold standard. SMS-only is no longer recommended.
2. Block legacy authentication
   POP, IMAP and SMTP-AUTH bypass MFA. Block them in Microsoft Entra Conditional Access.
3. Require MFA from outside trusted IP ranges
   Office IP whitelisted (low friction in office), MFA enforced everywhere else.
4. Block sign-ins from outside Australia (or only AU+NZ)
   Geo-blocking via Conditional Access — most attacks originate offshore.
5. Use FIDO2 hardware keys for admin accounts
   Yubikey or Microsoft passkey. Phishing-resistant.

Anti-Phishing & Safe-Links

Microsoft Defender for Office 365 (included in Business Premium and E5) ships with strong anti-phishing — most Brisbane SMEs we audit have it off or running on default settings.

Anti-phishing policies

• Mailbox intelligence on (learns who you usually email)
• Impersonation protection for VIPs (CEO, finance, partners)
• Spoof intelligence enabled
• Quarantine high-confidence phish

Safe-Links

• Real-time URL detonation in email and Teams
• Re-write URLs so post-delivery weaponisation is caught
• Apply to inbound, internal AND outbound

Safe Attachments & ATP

Defender for Office 365 detonates attachments in a sandbox before delivery. Critical for Brisbane SMEs that receive a lot of invoices, contracts and resumes — the highest-risk attachment categories.

• Block-action policy applied to all users
• Dynamic delivery on for admin/finance roles (preview while sandbox runs)
• Common attachment block — block .htm, .html, .iso, .scr at the gateway

Encryption & Sensitive Labels

For Brisbane SMEs in legal, finance or health — sensitivity labels and message encryption matter for both compliance and confidentiality.

• Sensitivity labels (Public, Internal, Confidential, Highly Confidential)
• Auto-classification of credit-card numbers, TFNs, Medicare IDs
• Message encryption applied automatically when label = Confidential or higher
• Conditional Access prevents copy/forward of encrypted mail

Monitoring & Alerts

Email security only works if you see what is happening. Configure these alerts:

1. Mass deletion alert
   Attacker often deletes evidence after BEC.
2. Unusual mail forward rules
   Most BEC attacks add an inbox rule that forwards finance emails offshore.
3. Risky sign-in alert
   Microsoft Entra flags impossible-travel logins (Brisbane + Lagos in 30 minutes).
4. Quarantine review weekly
   One person owns the quarantine — false positives released, real attacks reported.

Brisbane SME Rollout (Real Timeline)

Realistic schedule for a 10-25 person Brisbane SME on M365 Business Premium:

What It Costs in Brisbane