Microsoft 365 ships with defaults chosen to work reasonably for everyone, which means they are not tuned for anyone. A dozen or so settings account for most of the difference between a tenant that works well and one your team quietly resents.
Here are the ones we change on nearly every deployment, split by who needs to change them.
Security settings your administrator should set first
Multi-factor authentication on every account, with no exceptions. Not most accounts. Every one, including the owner, including the shared mailbox owner, including the account that only gets used quarterly. A single unprotected account is the whole point of the exercise for an attacker.
Legacy authentication disabled. Old protocols like IMAP, POP, and SMTP AUTH cannot enforce MFA. Turning them off closes an entire class of attack. Check first for scanners or copiers that still depend on them, then move those onto a modern path.
User consent for applications restricted. By default, users can grant third-party apps access to their mail and files without asking anyone. Requiring administrator approval for sensitive permissions takes two minutes and prevents a genuinely nasty attack.
Audit logging turned on and retained. If you ever need to investigate an incident, the logs need to have existed before the incident. Confirm unified audit logging is enabled and know how long your licence retains it.
External sender warnings enabled. A visible banner on messages from outside your organization is one of the cheapest anti-phishing controls available, and staff genuinely use it.
Mail settings that reduce daily friction
In Outlook, turn off desktop alerts for everything except the senders that matter. Constant popup interruptions are the main reason people report that email eats their day.
Turn on Undo Send and set the delay to ten seconds. It will save someone on your team from a genuinely bad moment at least once a year.
Set up Sweep and rules for newsletters and automated notifications so they route to a folder rather than the inbox. And enable Focused Inbox if your team likes it — but let people turn it off individually, because it splits opinion sharply.
OneDrive and SharePoint: the ones that prevent data loss
Turn on Known Folder Move, which redirects Desktop, Documents, and Pictures into OneDrive automatically. This single setting is the difference between a failed hard drive being an inconvenience and being a disaster, and it is off by default.
Enable Files On-Demand so staff see everything in the shared library without filling their local disk.
Review your external sharing settings. The default in many tenants allows anyone with a link to open a file, with no expiration. Set links to expire, and default them to specific people rather than anyone.
And confirm the recycle bin retention period, so people know how long they have to recover a deleted file themselves before it becomes a support ticket.
Teams settings worth a few minutes
Set quiet hours so notifications stop outside working hours — Teams will honor them, and staff will stop feeling on call.
Decide deliberately who can create teams. Unrestricted creation produces forty abandoned teams within a year, each with its own SharePoint site full of files nobody is managing. Restricting creation to a small group, with a simple request process, keeps the sprawl down.
Turn on meeting recording and transcription where it is appropriate for your business, and make sure everyone knows the policy on it.
The settings people ask about most
Two questions come up on nearly every onboarding call. Shared mailboxes versus distribution lists: use a shared mailbox when people need to reply as the address and see each other’s replies, and a distribution list when it is one-way. Getting this wrong is the cause of most “did anyone answer that?” confusion at a front desk.
Retention versus deletion: configure retention policies deliberately rather than letting mailboxes grow indefinitely, and align them with whatever retention schedule your business has agreed to.
A caveat about the admin center
Microsoft changes the location of these settings regularly, and the exact path depends on your licence tier. If a menu described here does not match what you see, the setting almost certainly still exists — it has moved.
It is also worth reviewing all of the above annually. New features arrive switched off, and old defaults change underneath you.
If you would like someone to go through your tenant and set these properly, get in touch. A configuration review usually takes a couple of hours and finds several things nobody knew were open.