If your business is running Microsoft 365 Business Standard or Business Premium, you’re already investing in one of the most capable productivity and security platforms available to small and medium-sized businesses. But did you know, most UK SMEs are using only a fraction of the security features included in their subscription?
These features don’t activate themselves. They need to be switched on, correctly configured, and actively managed, otherwise they’re simply not protecting you.
In this post, we’ll walk through the key security features included in your M365 plan, explain why they often go unused and show you how Black Swan Cyber Security Solutions, through our partnerships with Huntress and Octiga, can help you get the protection you’re already paying for.
What’s included in your M365 plan?
Before we dive in, a quick recap of what each plan offers from a security standpoint:
Microsoft 365 Business Standard
- Exchange Online email protected by Exchange Online Protection (anti-spam, anti-malware)
- Multi-Factor Authentication (MFA)
- Microsoft Secure Score access
- Desktop and web versions of Office apps, Teams, SharePoint, and OneDrive
Microsoft 365 Business Premium
Everything in Business Standard, PLUS:
- Microsoft Defender for Office 365 Plan 1 – Safe Links and Safe Attachments for email
- Microsoft Defender for Business (endpoint protection)
- Microsoft Intune – full device management (MDM/MAM)
- Azure AD Premium P1 – Conditional Access policies
- Azure Information Protection (data classification & labelling)
- Microsoft Entra ID (formerly Azure AD) identity protection
The security features most small businesses aren’t using
1. Multi-Factor Authentication (MFA)
Available on: Business Standard & Business Premium
MFA is arguably the single most effective security control you can enable and it costs nothing extra. Yet studies consistently show that a large number of SMEs still haven’t enforced it across their organisation. Without MFA, a stolen or phished password is all it takes to compromise your entire Microsoft 365 environment.
The challenge? Simply enabling MFA isn’t enough. It needs to be enforced via Conditional Access policies (Business Premium) or Security Defaults and exceptions must be carefully managed to avoid creating security gaps.
2. Microsoft Defender for Office 365 – Safe Links & Safe Attachments
Available on: Business Premium only
These features scan every email link and attachment in real time, rewriting URLs and detonating suspicious files in a sandbox before they reach your users. They’re included in your plan but they’re not turned on by default. Many SMEs are unaware they exist, let alone that they need configuring.
3. Conditional Access policies
Available on: Business Premium only
Conditional Access lets you set rules around who can access what, from where and under what conditions, for example, requiring MFA only when logging in from an unrecognised device, or blocking access from certain countries entirely. It’s one of the most powerful identity security tools available to SMEs, but requires careful planning and configuration to implement effectively.
4. Microsoft Defender for Business (endpoint protection)
Available on: Business Premium only
Microsoft Defender for Business is a full endpoint detection and response (EDR) solution built into Business Premium. It monitors devices for threats, provides attack surface reduction rules and offers vulnerability management. However, devices need to be enrolled and the solution needs ongoing monitoring – something that doesn’t happen automatically.
5. Microsoft Intune (device management)
Available on: Business Premium only
Intune allows you to manage and secure company devices – enforcing encryption, controlling which apps can be installed and remotely wiping devices if they’re lost or stolen. Without proper enrolment and policy configuration, your devices are unmanaged and potentially unsecured.
6. Azure Information Protection & Sensitivity Labels
Available on: Business Premium only
Classify and protect sensitive documents and emails with encryption and access restrictions that travel with the file, even outside your organisation. This is particularly relevant for businesses handling personal data under UK GDPR, financial information, or client confidentiality. Yet most SMEs have never activated it.
Why are these features going unused?
The reasons are familiar to anyone working in SME IT:
- No dedicated IT security resource internally
- Features aren’t enabled out of the box
- Configuration requires technical expertise
- No visibility into whether they’re working
- Alerts require someone to act on them
In short: Microsoft provides the tools, but not the expertise to configure, monitor, and respond. That’s where managed security support comes in.
Going beyond M365: Why Huntress ITDR makes a critical difference
Even with Microsoft Defender for Business fully configured, there are gaps. Microsoft’s built-in tooling is a strong baseline, but it’s designed to work within the Microsoft ecosystem and relies heavily on correct configuration and active monitoring.
This is where Huntress Identity Threat Detection and Response (ITDR) comes in. Identity-based attacks, including account takeover, business email compromise (BEC) and OAuth token abuse, are now among the most common ways attackers gain access to SME environments. Huntress ITDR is purpose-built to detect and respond to these threats within your Microsoft 365 environment.
Huntress ITDR sits on top of your existing M365 configuration and provides:
- 24/7 identity threat monitoring by a human Security Operations Centre (SOC)
- Detection of suspicious sign-ins, impossible travel and anomalous account behaviour
- Microsoft 365 OAuth and app consent abuse detection – a common entry point attackers use to maintain persistent access
- Business email compromise (BEC) detection – identifying inbox rule manipulation, forwarding rules and impersonation attempts
- Human-led investigation and remediation – not just alerts, but actual analysis and actionable guidance
- Plain-English incident reports your team can understand and act on, without needing a security degree
Crucially, Huntress ITDR is designed specifically for SMEs – it’s not a scaled-down enterprise tool. It acknowledges that most small businesses don’t have a dedicated security team, so the Huntress SOC acts as an extension of your own capabilities.
“It’s in the cloud” doesn’t mean it’s backed up
This is one of the most dangerous misconceptions we encounter. Many business owners assume that because their emails, files and Teams messages are stored in Microsoft’s cloud, they’re automatically protected and recoverable. They’re not, at least, not in the way most people think.
Microsoft’s Shared Responsibility Model
Microsoft operates under a Shared Responsibility Model. This means Microsoft is responsible for keeping the infrastructure, datacentres and platform available and secure. But the responsibility for your data, what’s in it, how it’s protected and whether it can be recovered, sits with you, the customer.
Microsoft’s own documentation makes this clear. They recommend, (and in some cases explicitly state), that customers use third-party backup solutions to protect their Microsoft 365 data. The platform is designed for availability, not for granular recovery.
What M365 doesn’t protect you against
- Accidental deletion – if a user deletes emails or files, they may only be recoverable for a limited window (typically 30–93 days depending on your plan and settings)
- Ransomware – attackers can encrypt or delete your SharePoint and OneDrive data. Version history helps, but it’s not a substitute for a proper backup
- Malicious insiders – a disgruntled employee can permanently delete data before you realise what’s happened
- Account compromise – if an attacker gains access, they can delete or exfiltrate data with no native recovery option
- Licensing lapses – if a user licence expires or is removed, access to their mailbox and data may be lost
What you should be backing up
A proper Microsoft 365 backup solution should cover:
- Exchange Online mailboxes (emails, calendars, contacts)
- SharePoint Online sites and libraries
- OneDrive for Business files
- Microsoft Teams conversations and data
At Black Swan Cyber Security Solutions, we can advise on and implement the right backup solution for your business – ensuring your data is recoverable quickly, reliably and completely, regardless of what happens.
How Black Swan Cyber Security Solutions can help
At Black Swan, we specialise in helping UK SMEs make the most of the security tools they already have and layering in the additional protection needed to stay genuinely secure.
Through our partnerships with Huntress and Octiga, we provide a complete, managed approach to Microsoft 365 security that combines configuration management, identity posture hardening, and active threat detection:
Octiga – Automated M365 security management
Octiga is a Microsoft 365 security management platform that gives us continuous visibility into your M365 configuration. We use it to:
- Assess your current security posture against best-practice benchmarks
- Identify misconfigured or disabled security features
- Enforce and maintain secure configurations automatically
- Monitor for configuration drift, so if someone inadvertently changes a setting, we know about it
- Provide audit-ready reporting for Cyber Essentials or insurance purposes
Huntress ISPM – Identity Security Posture Management
While Octiga keeps your M365 configuration secure, Huntress ISPM (Identity Security Posture Management) goes deeper – focusing specifically on the health and security of every identity in your environment.
You can’t protect what you can’t see. In a modern Microsoft 365 environment, ‘identity’ isn’t just your staff, it’s service accounts, API connections, third-party app permissions and automated processes. These accumulate over time, often without anyone noticing, and each one is a potential entry point for attackers.
Think of ISPM as a continuous health check for your entire identity infrastructure. Huntress ISPM surfaces identity risks before attackers can exploit them:
- Dormant accounts – former employees whose accounts were never disabled, sitting as an open door into your systems
- Over-privileged accounts – users or services that have accumulated permissions well beyond what their role requires
- Rogue OAuth apps – third-party applications granted access to your M365 data, often unknowingly by staff clicking ‘allow’
- MFA gaps – admin or user accounts where MFA enforcement has been missed or bypassed
- Policy drift – security configurations that have silently degraded due to routine IT changes over time
- Unmanaged shadow identities – accounts created through SaaS tools outside of IT’s oversight
ISPM is proactive and preventative – it finds the unlocked doors before a threat actor walks through them. This complements Huntress ITDR, which monitors for active identity threats in real time. Together, ISPM and ITDR provide both the posture hardening and the active detection your M365 environment needs.
Huntress ITDR – Identity Threat Detection and Response
As a Huntress partner, we deploy and manage Huntress ITDR across your Microsoft 365 environment. This means:
- 24/7 SOC monitoring for identity-based threats within your M365 environment
- Human-led investigation of suspicious sign-ins, account anomalies, and OAuth abuse
- Business email compromise detection – catching inbox manipulation before it causes financial or reputational damage
- Rapid incident response with plain-English guidance – so you always know exactly what happened and what to do next
Stop leaving security features switched off and your data unprotected
Your Microsoft 365 subscription already includes some powerful security capabilities. The problem isn’t what you’ve bought, it’s that nobody has turned them on, configured them properly, or is actively monitoring them.
And while those features sit dormant, your data sits in the cloud with no real backup – exposed to accidental deletion, ransomware and account compromise. Microsoft provides the platform. Protecting what’s on it is your responsibility.
Cyber threats targeting UK SMEs are increasing in sophistication and frequency. Ransomware, business email compromise and account takeovers are everyday occurrences and they often succeed because basic security controls were left unconfigured and data was never properly backed up.
If you’re ready to start getting real value from your Microsoft 365 investment, with Huntress ITDR protection and proper backup in place, get in touch today.
