Locking Down Exchange Online: Ten Security Settings Most Tenants Still Miss
Exchange Online has strong security capabilities built into Microsoft 365.
That does not mean a newly created tenant is automatically hardened for your particular business.
Many organisations enable MFA, configure their domain and assume email security is largely finished.
Meanwhile:
old SMTP AUTH dependencies remain
external forwarding is poorly controlled
executives have weak impersonation protection
users can authorise unnecessary third-party apps
email authentication never progresses beyond SPF
old transport-rule exceptions remain indefinitely
Attackers know where these gaps are.
The aim of Exchange Online hardening is not to make email difficult to use.
It is to reduce the number of ways an attacker can:
steal access → maintain access → impersonate users → move information outside the organisation.
Here are ten areas I would review in a Microsoft 365 tenant in 2026.
1. Use Microsoft’s Preset Security Policies
A good starting point is:
Microsoft Defender > Email & collaboration > Policies & rules > Threat policies > Preset Security Policies
Microsoft provides:
Standard protection
and:
Strict protection
which combine recommended settings across anti-phishing and, where the appropriate Defender for Office 365 licensing exists, protections such as Safe Links and Safe Attachments.
Microsoft generally recommends these presets rather than manually recreating every recommended setting yourself.
For many SMEs, a sensible model is:
Standard
for most users.
Strict
for higher-risk users such as:
administrators
directors
finance
payroll
employees authorising payments
Test policies with a pilot group before broad deployment.
The advantage is not merely better initial configuration.
Preset policies also reduce configuration drift because Microsoft maintains the security settings as its recommendations evolve.
2. Configure Impersonation Protection Properly
Spoofing and impersonation are not exactly the same thing.
Spoofing attempts to make a message appear to come directly from another sender or domain.
Impersonation can use:
similar-looking domains
similar display names
near-identical addresses
to convince the recipient that somebody trusted sent the message.
Microsoft Defender for Office 365 provides advanced protections against user and domain impersonation in addition to the anti-spoofing capabilities available to cloud mailboxes.
Protect people attackers are particularly likely to imitate:
directors
finance staff
payroll
HR
administrators
payment approvers
Also consider important:
company domains
suppliers
external organisations frequently involved in payments
Do not configure the list once and forget it.
Review it when:
directors change
suppliers change
finance responsibilities change
phishing patterns change
3. Block Automatic External Forwarding
A compromised mailbox becomes much more useful to an attacker if incoming messages can silently be copied elsewhere.
The attacker may create forwarding for:
invoices
password resets
customer messages
security warnings
while the legitimate user continues using the mailbox normally.
Microsoft now treats Automatic — System-controlled in its outbound spam policy the same as Off, meaning automatic external forwarding is disabled by default under that setting.
I would nevertheless make the policy explicit:
Automatic forwarding rules: Off
That makes the intended security posture much easier to audit.
If a legitimate workflow genuinely needs external forwarding—for example, a ticketing system—create a narrowly scoped exception rather than enabling it for everyone.
4. Disable SMTP AUTH Unless Something Genuinely Needs It
SMTP AUTH remains common because of:
scanners
multifunction printers
old applications
reporting systems
Modern Outlook clients do not generally need it.
Microsoft explicitly recommends disabling SMTP AUTH across the organisation and enabling it only for mailboxes that still require it.
Check the tenant:
Get-TransportConfig |
Format-List SmtpClientAuthenticationDisabled
For a mailbox:
Get-CASMailbox user@company.co.uk |
Format-List SmtpClientAuthenticationDisabled
Where possible, use:
Set-TransportConfig -SmtpClientAuthenticationDisabled $true
and create only documented exceptions.
Also remember:
SMTP AUTH itself can use OAuth.
The bigger problem is often a legacy device still relying on stored credentials or Basic authentication.
Microsoft has already removed Basic authentication from most Exchange Online protocols and continues to push customers towards Modern Authentication/OAuth.
An old scanner should not become the reason every mailbox retains an unnecessary authentication route.
5. Complete SPF, DKIM and DMARC
SPF alone is not a finished email-authentication strategy.
You ideally want:
SPF + DKIM + DMARC
working together.
Broadly:
SPF
identifies authorised sending infrastructure.
DKIM
cryptographically signs outbound mail.
DMARC
checks alignment and tells receiving systems how to handle mail that fails authentication.
For businesses using several systems to send mail—Microsoft 365, CRM, marketing platform, ticketing system, accounts package—the difficult part is identifying every legitimate sender.
A sensible DMARC journey is:
1. Inventory legitimate sending services.
2. Correct SPF.
3. Enable DKIM for the appropriate sending domains.
4. Publish DMARC using monitoring first.
5. Review reports.
6. Correct legitimate alignment failures.
7. Progress towards quarantine.
8. Move to reject when confident.
Do not jump immediately to:
p=reject
without knowing what sends email using your domain.
You may block legitimate business systems along with the attackers.
6. Protect Administrator Accounts With Stronger MFA
Having MFA is important.
But all MFA methods do not provide equal protection.
Microsoft Entra now supports authentication strengths, including:
ordinary MFA
passwordless MFA
phishing-resistant MFA
and Microsoft specifically recommends phishing-resistant MFA for privileged roles including Exchange Administrator, Global Administrator, Security Administrator and Conditional Access Administrator.
Phishing-resistant methods can include supported configurations based on:
passkeys/FIDO2
Windows Hello for Business
certificate-based authentication
For administrator accounts, I would also review:
how many administrators exist
whether admins use privileged accounts for everyday email
emergency-access accounts
standing privilege
The Exchange mailbox may be well protected while the administrator capable of changing its security policies is not.
That is the wrong way round.
7. Control OAuth and Application Consent
This deserves much more attention in a 2026 Exchange Online security article.
An attacker does not necessarily need to steal your password repeatedly.
A malicious or compromised application can request permission to access Microsoft 365 information on a user's behalf.
Depending on the permission granted, an application may potentially access resources such as mailbox information.
Microsoft Entra allows organisations to control whether users can consent to applications and can restrict consent to areas such as:
verified publishers + selected low-impact permissions.
For more sensitive permission requests, businesses can use an admin consent workflow so employees can request approval rather than simply being blocked or granting broad permissions themselves.
Review:
Enterprise applications
application permissions
consent grants
unfamiliar apps
unused apps
overly broad permissions
This matters particularly after a suspected mailbox compromise.
Changing the password may not remove access already granted to a malicious application.
8. Tighten Quarantine, Safe Links and Safe Attachments
Where Defender for Office 365 licensing is available, Safe Links and Safe Attachments provide significant additional protection.
Safe Links
Checks supported URLs when users click them.
This helps with malicious sites that:
were harmless when the message arrived
became malicious afterwards
redirect through other infrastructure
Safe Attachments
Analyses potentially malicious files in a sandboxed environment.
Rather than creating dozens of independent custom policies, Microsoft generally recommends using Standard and Strict preset security policies as the starting point.
Also review quarantine permissions.
Users should not necessarily be able to release every category of message themselves.
Particularly sensitive categories include:
high-confidence phishing
malware
dangerous attachments
A security system that correctly quarantines malware but lets an employee immediately deliver it back to themselves is not being used effectively.
9. Audit Transport Rules, Allow Lists and Bypass Entries
Exchange mail-flow rules are extremely powerful.
They can:
redirect mail
blind-copy recipients
alter messages
bypass filtering
set spam confidence levels
That means old rules deserve regular review.
Look carefully at rules that:
set SCL to -1
bypass spam checking
bypass security products
redirect externally
BCC another recipient
trust whole domains
depend on easily forged headers
Your current article already correctly identifies this as one of the biggest long-term configuration-drift risks.
Every exception should ideally have:
business reason
owner
narrow scope
review date
If somebody added:
Allow everything from example.com
two years ago because one invoice landed in quarantine, ask whether that exception is still justified.
The same applies to:
Tenant Allow/Block List
spoof overrides
anti-spam allow entries
connector exceptions
Security exceptions have a habit of becoming permanent unless somebody owns their removal.
10. Verify Auditing, Alerts and Compromise Detection
Microsoft enables mailbox auditing by default in Exchange Online organisations.
It records defined actions performed by:
mailbox owners
delegates
administrators
and Microsoft says newly created mailboxes automatically inherit this auditing model.
Verify that organisation-wide auditing has not been disabled:
Get-OrganizationConfig |
Format-List AuditDisabled
You normally want:
AuditDisabled : False
Then make sure somebody is actually paying attention to relevant security alerts.
Examples include:
suspicious outbound mail
restricted users/entities
unusual forwarding
inbox-rule creation
suspicious administrative changes
phishing campaigns
connector changes
If Microsoft restricts an account for suspicious outbound activity, do not simply click:
Unblock
because the employee needs email.
First investigate:
sign-ins
sessions
inbox rules
forwarding
MFA changes
OAuth consent
sent messages
Then secure the account and remove any attacker persistence.
A Better Exchange Online Hardening Order
I would roll these controls out approximately like this:
1. Confirm MFA and privileged-account security.
2. Apply Standard preset protection to a pilot group.
3. Apply stricter protection to high-risk users.
4. Block external auto-forwarding.
5. Audit SMTP AUTH and retire legacy dependencies.
6. Configure impersonation protection.
7. Complete SPF/DKIM/DMARC.
8. Review OAuth/application consent.
9. Audit transport rules, connectors and allow lists.
10. Verify auditing and alert-response procedures.
Email is business-critical.
Make changes using:
pilot groups
documented change control
testing
rollback plans
Do not turn on ten policies simultaneously and then try to work out which one stopped the finance application from sending invoices.
Ten Exchange Online Mistakes I Would Look for Immediately
A quick tenant review would look for:
Standard/Strict preset policies not assigned
executives missing from impersonation protection
external forwarding enabled broadly
SMTP AUTH unnecessarily available
DMARC still at p=none years after deployment
weak administrator authentication
unrestricted or poorly governed application consent
users able to release highly dangerous quarantined mail
old transport-rule/allow-list exceptions
nobody reviewing alerts or audit evidence
One of these alone may not result in compromise.
Several together create a much easier environment for an attacker.
Exchange Online Security Is More Than Email Filtering
This is probably the most important 2026 point.
Protecting Exchange Online is not simply about deciding whether an incoming message is:
spam or not spam.
Modern email security involves:
Identity
Who is allowed to authenticate?
Applications
Which software can access the mailbox?
Mail flow
Where can messages be redirected?
Sender authentication
Can attackers convincingly impersonate your domain?
Content protection
Are malicious URLs and attachments detected?
Monitoring
Would you notice an attacker changing the mailbox?
All of those layers matter.
How Hamilton Group Can Help
Hamilton Group can help businesses review and harden Exchange Online and the Microsoft 365 identity controls around it.
We can help with:
Exchange Online security
Microsoft Defender for Office 365
Standard and Strict preset policies
impersonation protection
Safe Links and Safe Attachments
external forwarding controls
SMTP AUTH
SPF, DKIM and DMARC
Conditional Access
phishing-resistant MFA
OAuth/application consent
mailbox auditing
compromised-mailbox investigations
The objective is not to create the highest possible number of restrictions.
It is to close unnecessary routes into and out of the mailbox while allowing legitimate business email to continue working.
Visit hgmssp.com or call 0330 043 0069 to discuss a Microsoft 365 security review.