Microsoft 365 Security for Accounting Practices

Microsoft 365 security starts with protected sign-ins, email filtering and restricted client folders. Review existing permissions before enabling Copilot, because it uses the access staff already have.

Microsoft 365 Security Features by Plan

Business Premium is a practical starting point for a small practice that wants Microsoft’s device management and stronger email protection together. Business Standard needs separately arranged protection for those jobs.

The table summarises the relevant inclusions in Microsoft’s suite comparison. It compares the base subscriptions, before add-ons.

Premium combines sign-in conditions with managed devices. Its security documentation confirms Entra ID P1, Intune and Defender for Business. Buying the licence still leaves policies and device enrolment to configure.

Microsoft 365 E5 security features suit practices that need deeper investigation and governance, with someone assigned to use them. Defender for Office 365 Plan 2 adds investigation and response automation, plus phishing simulations.

Entra ID P2 adds risk-based sign-in policies and privileged access management. These can justify E5 when the practice has a defined requirement for them. E5 is not a prerequisite for restricting client-folder access.

Use the full subscription name in the review. Microsoft 365 E5, Office 365 E5 and security add-ons are different packages. Ask your IT provider to list assigned licences and the policies each actually enables.

Email Security Settings

Check sign-in protection and the policies applied to every mailbox, including shared mailboxes. A licence inventory alone does not show whether those protections are working.

Require Multifactor Authentication

Multifactor authentication (MFA) adds a sign-in check beyond the password. Confirm that staff register a method and that policy requires its use, including for administrators.

For basic identity licensing, security defaults require MFA registration and protect sign-ins under Microsoft’s rules. They also block older sign-in methods. Administrators and ordinary users have different enforcement conditions.

With Entra ID P1 or P2, use Conditional Access to set the required sign-in conditions. Your IT provider must inspect policy coverage and exclusions before replacing security defaults. Keep a tested recovery route for administrator access.

Review Anti-Phishing Policies

Microsoft’s anti-phishing guidance distinguishes default anti-spoofing from impersonation protection. The default anti-phishing policy does not turn impersonation protection on.

For licensed mailboxes, configure protection for the principal and other staff commonly impersonated in payment requests. Review protected domains and the action taken on suspicious messages. Check which recipients each policy covers.

Confirm Safe Links and Safe Attachments coverage where licensed. Built-in protection supplies default coverage, but exclusions and other policies affect the result. Assign someone to review quarantined messages and staff reports of suspicious email.

Show External Sender Warnings

Enable external sender identification in Outlook. Ask your IT provider to check its enabled state and any sender exceptions.

Send an ordinary message from outside the practice and confirm the External indicator appears in supported Outlook versions. Microsoft allows 24 to 48 hours for a newly enabled setting to appear. The label identifies origin, not trustworthiness.

Confirm Mailbox Auditing

Mailbox auditing records supported actions by mailbox owners, delegates and administrators. Microsoft turns it on by default, but the review must confirm the organisation setting and a usable audit search.

Microsoft’s mailbox auditing instructions identify AuditDisabled as the organisation setting. False means default auditing is on. Also review bypasses and the actions recorded for the mailbox types your practice uses.

Have your provider find a known, supported mailbox event in the audit log. Record the available retention period and who investigates alerts. A missing event needs investigation before anyone relies on the log for incident evidence.

OneDrive and SharePoint Sharing

Use named recipients and limited permissions for client documents. Review existing access as well as the default for the next link someone creates.

In the SharePoint admin centre, open Policies, then Sharing. Microsoft’s sharing settings set organisation-wide limits. Individual sites can be more restrictive, and OneDrive cannot be more permissive than SharePoint.

1. Set the permitted external-sharing level for SharePoint and OneDrive. Allow guest collaboration only where the practice needs it.
2. Choose Specific people as the default link type for client files, with View as the default permission where editing is unnecessary.
3. Inspect site-specific overrides under Active sites, then Sharing. Microsoft documents the site-level default settings.
4. Review existing links and group memberships on client sites and folders. Remove unnecessary grants after confirming the intended recipients with the file owner.
5. Test a replacement link with the named recipient and with an account that must not receive access.

An Anyone link can work without signing in. A Specific people link limits use to its named recipients. Microsoft explains each link type, including links for people inside the organisation.

Changing the default helps the next sharing action. It does not replace a review of old links, inherited permissions or membership of broad staff groups.

Find Folders Open to Everyone

Inspect client sites for Everyone except external users, organisation-wide links and staff groups wider than the client team. Trace inherited access back to the site or group granting it.

Ask a site owner to identify the intended team for each client folder. Compare that list with direct permissions and group membership. Investigate unexpected access before removing a group used by another legitimate service.

Where licensed, SharePoint Advanced Management supplies permission-state and broad-access reports. Use them to find sites requiring review, then inspect the actual grants. A report does not decide which staff need a particular client’s records.

Microsoft confirms that Copilot respects existing permissions. If a broad group already has access, Copilot can surface information within that access. Correct the permission before treating the folder as restricted.

For the separate question of what the assistant can retrieve, read the Copilot privacy guide.

A Microsoft 365 Security Review

Run this short Microsoft 365 security assessment with your IT provider. Use a test document containing invented information for access checks, and retain the results outside client folders being assessed.

Assign each failed check to a named person and record the action required. If access is unexpectedly broad, correct it and repeat the same access test before expanding Copilot use.

If a legitimate recipient loses access, inspect the intended invitation and group membership. Restore the specific permission needed instead of making the whole site broadly accessible.

Keep Microsoft 365 findings alongside the wider cyber security checklist for accountants. Close the review when the failed checks have evidence of correction and each ongoing task has an owner.