Microsoft 365 is the most widely used business platform in Australia - but most Perth businesses only use a fraction of what they're paying for. Email, Teams, and Word are the visible tip. Underneath is a comprehensive security platform that most businesses leave untouched, even though it is included in their subscription.
Security Defaults - Enable This First
If you have Microsoft 365 and haven't configured Conditional Access, the first thing to do is enable Security Defaults in the Microsoft Entra ID (Azure AD) admin centre. Security Defaults:
- Requires all users to register for MFA
- Blocks legacy authentication protocols (SMTP AUTH, IMAP, POP3) that cannot enforce MFA
- Requires MFA for privileged administrator actions
Security Defaults is a single toggle that takes three minutes to enable and immediately closes the most common attack vectors. It is available on every Microsoft 365 plan at no extra cost.
If you have Microsoft 365 Business Premium or an E3/E5 plan, you should use Conditional Access policies instead of Security Defaults - they give you more granular control over when and how MFA is required.
Microsoft Defender for Business (Business Premium)
Microsoft 365 Business Premium includes Microsoft Defender for Business - a full endpoint detection and response (EDR) platform that monitors every managed device for threats, behavioural anomalies, and active attacks.
Defender for Business replaces the need for a separate third-party antivirus on Windows devices. It provides:
- Real-time threat detection and automated response (quarantine malicious files, isolate compromised devices)
- Attack surface reduction rules - blocking common malware techniques before they execute
- Vulnerability management - identifying unpatched software and misconfigured settings across all managed devices
- Threat hunting - a dashboard showing active threats, resolved incidents, and security recommendations across your whole device fleet
Many Perth businesses on Business Premium are paying for Defender for Business but have never onboarded their devices into it. If that's you, contact your IT provider - this is a significant security capability you're leaving on the table.
Microsoft Defender for Office 365 - Email Protection
Email is the primary attack vector for Perth businesses. Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, which provides:
Safe Links
Every URL in an email is rewritten and checked against Microsoft's threat intelligence in real time when the user clicks it. If a link was benign when delivered but has since been flagged as malicious (a common technique where attackers use clean URLs that redirect to malware after delivery), Safe Links blocks the click.
Safe Attachments
Every email attachment is detonated in a sandboxed virtual machine before delivery. If the attachment behaves maliciously in the sandbox, it is blocked before it reaches the user's inbox. This catches novel malware that signature-based scanners miss.
Anti-phishing policies
Defender for Office 365 includes impersonation protection - detecting emails that claim to be from your CEO, a known supplier, or a trusted brand, and flagging or blocking them. This directly addresses business email compromise (BEC) attacks.
Microsoft Secure Score
Every Microsoft 365 tenant has a Secure Score - a dashboard in the Microsoft Defender portal that scores your security configuration out of 100 and lists specific recommended actions to improve it.
Each recommendation comes with:
- A point value (how much it improves your score)
- An implementation guide (step-by-step instructions)
- A risk assessment (what threat it mitigates)
A typical Perth business on Microsoft 365 with no security hardening starts with a Secure Score around 20–35 out of 100. Working through the top recommendations can get most businesses to 60–75 without any additional licences. The recommendations are prioritised by impact - address the highest-value items first.
Conditional Access - Control Who Logs In From Where
Available with Microsoft 365 Business Premium and above, Conditional Access policies let you define rules that control access to Microsoft 365 resources. Examples:
- Require MFA when signing in from outside Australia
- Block sign-ins from known anonymous proxy services and Tor exit nodes
- Require a compliant, Intune-managed device to access SharePoint and Teams
- Block access to company email on devices that haven't been seen in 90 days (likely a departed staff member's device)
- Grant access without MFA from compliant devices in the office (reducing friction for staff)
Microsoft Purview - Information Protection
For Perth businesses handling sensitive data - financial records, health information, legal documents, or client PII - Microsoft Purview (formerly Azure Information Protection) lets you classify and protect documents:
- Apply sensitivity labels to documents (Confidential, Internal, Public)
- Automatically encrypt documents labelled Confidential so they can only be opened by authorised users
- Prevent confidential documents from being forwarded, printed, or copied outside your organisation
- Audit who has accessed protected documents
Purview is particularly relevant for law firms, accountants, healthcare practices, and any Perth business subject to the Privacy Act's data protection requirements.
Are You Getting Value From Your Microsoft 365 Licence?
A quick self-check: if you are on Microsoft 365 Business Premium and any of the following are true, you are paying for security features you are not using:
- Devices are not enrolled in Microsoft Intune
- Safe Links and Safe Attachments are not configured
- Your Secure Score is below 50
- You have no Conditional Access policies configured
- Defender for Business is not monitoring your devices
Frequently Asked Questions
What's the quickest security win if I haven't touched any settings yet?
Turning on Security Defaults in the Microsoft Entra admin centre. It's a single toggle, takes a few minutes, and immediately requires MFA for everyone, blocks outdated login methods attackers rely on, and protects admin accounts. It's included on every Microsoft 365 plan at no extra cost.
What is Secure Score and what's a good number to aim for?
Secure Score is a built-in dashboard in the Microsoft Defender portal that rates your security configuration out of 100 and lists specific fixes to improve it. Most Perth businesses start somewhere between 20 and 35 with no hardening done, and working through the top recommendations can typically get that into the 60s or 70s without buying anything extra.
Do I need Business Premium to get real security features, or does Standard include them?
Standard covers the core Office apps, Teams, and email, but the deeper protections, Defender for Business, Conditional Access, Safe Links and Safe Attachments, and Microsoft Purview, are Business Premium (or E3/E5) features. If you're only on Standard, those tools simply aren't available to turn on yet.
Is Microsoft Purview relevant if I'm not a law firm or medical practice?
It's most valuable for businesses handling sensitive data such as financial records, health information, or client personal details, and businesses in that position should look into their obligations under the Privacy Act. That said, any business that wants to stop confidential documents being forwarded or copied outside the organisation can get value from it, so it's worth a look even outside regulated industries.
We configure and manage the full Microsoft 365 security stack for Perth businesses - Defender, Conditional Access, Intune, and Secure Score hardening.
Microsoft 365 Services →Are you getting full value from your Microsoft 365 subscription?
Call 0433 087 091 - we'll review your Microsoft 365 security configuration and identify what you should have enabled.
Book a Microsoft 365 ReviewFor related reading, see our guides to Microsoft Intune for Perth Businesses and Microsoft 365 Business Premium vs Standard for Perth Businesses.