If your Frederick County business runs on Microsoft 365 — and most small businesses around Frederick, Middletown, and Walkersville do — you’ve already got powerful security tools built in. The catch? A lot of them aren’t turned on by default.
Microsoft 365 email compromise is one of the most common ways small businesses get hit. An attacker gets into one mailbox, quietly forwards invoices, and your customers end up paying the wrong account. The good news: seven simple settings can block most of these attacks. Here’s the plain-English checklist we walk Frederick-area businesses through.
1. Turn on multi-factor authentication (MFA) for everyone
This is the single biggest win. MFA means signing in takes your password plus a quick approval on your phone. Even if someone steals a password, they can’t get in without that second step. Turn it on for every account — owners, staff, and especially admins.
2. Block old-style sign-ins
Older email protocols (called IMAP and POP) let attackers try passwords over and over without triggering MFA. Most businesses don’t use them anymore, so switch them off. It’s a one-time change in the admin settings and it closes a favorite hacker backdoor.
3. Set up email anti-spoofing (SPF, DKIM, and DMARC)
These three records prove that email claiming to be from your business actually is. Without them, scammers can send fake invoices that look like they came from you. With them in place, those fakes get flagged or blocked. Your customers and vendors stay protected, and your real mail lands in inboxes more reliably.
4. Review who has admin access — and shrink the list
Too many small businesses have five or six “global admins” from old setups. Every extra admin account is extra risk. Keep it to one or two named people, and give everyone else only the access they need for their job.
5. Turn on audit logging and check forwarding rules monthly
Attackers who break into a mailbox often set a hidden rule that forwards your mail to them. Audit logging records what’s happening in your accounts so problems can be spotted fast. Once a month, have someone check for forwarding rules nobody recognizes.
6. Use the built-in phishing and attachment protection
Microsoft 365 includes tools that scan attachments and links before your team clicks them. Make sure Safe Attachments and Safe Links are turned on — they catch a lot of the junk that makes it past the spam filter.
7. Back up Microsoft 365 — yes, really
Microsoft keeps your data running, but if an employee deletes files or ransomware encrypts them, recovery isn’t guaranteed. A separate backup of your mailboxes, OneDrive, and SharePoint means you can restore yesterday’s files without paying anyone or losing weeks of work.
You don’t have to do all seven in one day. Start with MFA and blocking old sign-ins — those two alone stop the most common attacks. Then work down the list over the next few weeks.
Not sure where your Microsoft 365 security stands? West Main Tech Services in Middletown helps Frederick County small businesses lock down Microsoft 365 every day. Call us at (240) 490-9703 and we’ll walk through this checklist with you — no jargon, no pressure, just a clear picture of what’s protected and what’s not.