// Key takeaway
Enforce MFA on every account, block legacy authentication, control external forwarding, separate admin accounts and alert on suspicious sign-ins.
Enforce multi-factor authentication
Stolen passwords are the most common way into a Microsoft 365 tenant. MFA on every account, including shared and admin accounts, stops the majority of these attacks.
Block legacy authentication
Older protocols bypass MFA. Disable them unless a specific, documented system still needs them.
Control mail forwarding
Attackers set up forwarding rules to quietly copy mail out. Allow external forwarding only where it is genuinely needed, and review the rules regularly.
Separate admin accounts
Administrators should use a separate account for admin work, never their everyday mailbox account.
Alert and review
Turn on alerts for unusual sign-ins and new forwarding rules, and have someone responsible for acting on them.
Published 16 October 2026 by the Digital Hosting Services engineering team, York.
Want an engineer to look at your situation?
Get in touch