When you use Microsoft 365 for your business email, it's important to consider how well your email security is managed. This means not just relying on Microsoft's built-in protections, but also checking how your IT supplier handles additional security layers, monitoring, and response to threats. Including Microsoft 365 email security in your supplier questionnaires helps ensure your provider takes responsibility for protecting your email system from common risks like phishing, malware, and data leaks.
Why this matters for UK SMEs
Email remains one of the top entry points for cyberattacks, especially phishing and ransomware. A successful attack can cause downtime, loss of sensitive data, damage to your reputation, and regulatory headaches under UK GDPR and the Data Protection Act 2018. For example, a small business with 50 staff might suddenly find their inboxes flooded with fraudulent emails or, worse, have their email accounts compromised, leading to unauthorised access to personal customer information or financial data.
Beyond compliance, poor email security can disrupt your team's productivity and erode customer trust. Customers expect their data to be handled securely, and any breach or persistent spam issues can harm your business relationships. Having clear expectations about email security in your supplier agreements helps reduce these risks and ensures you can recover quickly if an incident occurs.
Typical scenario
Consider a UK-based SME with around 100 employees using Microsoft 365 for email and collaboration. They notice an increase in phishing emails bypassing default filters, and some staff report suspicious login alerts. Their managed IT provider steps in to review the Microsoft 365 security settings, enabling Multi-Factor Authentication (MFA) for all users, configuring advanced threat protection policies, and setting up regular security monitoring and incident response procedures. This proactive approach reduces the risk of account compromise and helps the business meet Cyber Essentials Plus requirements.
What to ask your IT provider
- Do you manage Microsoft 365 email security settings beyond the default configuration?
- How do you handle spam filtering, phishing protection, and malware scanning?
- Is Multi-Factor Authentication (MFA) enforced for all email accounts?
- Do you monitor email logs and alerts for suspicious activity?
- How quickly can you respond to and remediate email security incidents?
- Can you provide evidence of compliance with relevant standards like Cyber Essentials or ISO 27001?
- Do you assist with user training or awareness around email security risks?
Simple internal checks
- Review your Microsoft 365 admin portal to confirm MFA is enabled for all users.
- Check spam and phishing filter settings and quarantine policies.
- Verify who has administrative access to your Microsoft 365 environment.
- Ensure regular backups of email data are in place and tested.
- Confirm your provider has documented incident response procedures for email security events.
Including Microsoft 365 email security in your supplier questionnaires is a practical step to managing cyber risk and protecting your business communications. It helps clarify responsibilities and ensures your IT partner is aligned with your security needs and compliance obligations. If you're unsure about your current setup or how to improve it, speak with a trusted managed IT provider or IT advisor who can review your email security posture and recommend tailored improvements.