Microsoft 365 Security for Malaysian SMEs: A 10-Setting Baseline

A sensible Microsoft 365 security baseline for a Malaysian SME comes down to ten settings: MFA for everyone, legacy sign-in blocked, few admins, emergency access accounts, controlled sharing, email authentication, preset threat policies, managed devices, data loss prevention and a monthly review. Most work on any Microsoft 365 for business plan. The Cyber Security Act 2024 adds legal duties only for designated NCII entities.

At a glance

First, know which plan you have

Microsoft 365 for business comes as Business Basic, Business Standard and Business Premium, and Microsoft's security best practices for business are written for organisations with up to 300 users. All three plans include Microsoft Entra ID Free, built-in email protection against malware, spam and spoofing, and Basic Mobility and Security for phones. Business Premium adds Microsoft Entra ID P1 (which brings Conditional Access), Microsoft Intune Plan 1, Microsoft Defender for Office 365 Plan 1, Microsoft Defender for Business, and Microsoft Purview data loss prevention and sensitivity labels.

Two mistakes come up again and again. One is paying for Business Premium and never switching its features on. The other is a mix of plans, so some staff are protected and others are not. Check Billing, then Your products, in the Microsoft 365 admin center before you change anything.

The ten settings

1. Turn on MFA for every user

On Basic and Standard, use security defaults in Microsoft Entra ID. They make every user register for MFA, require admins to use MFA, block legacy authentication and block device code flow. Microsoft removed the old 14-day registration grace period on 29 July 2024, so users register when they first sign in. On Business Premium you can move to Conditional Access, which sets rules by user, app, location and device, but you must turn security defaults off first and replace every protection they gave you. Microsoft-managed Conditional Access policies help with that.

Microsoft now also enforces MFA itself for its admin portals: the Azure portal, Microsoft Entra admin center and Intune admin center from October 2024, and the Microsoft 365 admin center from February 2025. Treat that as the floor, not your plan.

2. Block legacy authentication

Old protocols such as POP3, IMAP and basic-authentication SMTP cannot do MFA, which is why attackers use them to get around it. Security defaults block them. Before you switch, look for old scanners, printers or business apps that send mail with a username and password, and move them to a supported method first.

3. Keep admins few and roles narrow

The person who signed up for Microsoft 365 is a Global Administrator by default, and in many SMEs so are the director, the IT vendor and someone who left two years ago. Give each person the narrowest role that does the job, such as User Administrator for creating accounts or Helpdesk Administrator for password resets. Admins should do daily work in a normal account and use a separate admin account only when needed. You can list current Global Administrators with Microsoft Graph PowerShell:

$roleName = "Global Administrator"
Connect-MgGraph -Scopes "Directory.Read.All"
Get-MgDirectoryRole | Where-Object { $_.DisplayName -eq $roleName } |
  ForEach-Object { Get-MgDirectoryRoleMember -DirectoryRoleId $_.Id }

Remove anyone who should not be on that list, especially former staff and old vendors.

4. Create two emergency access accounts

Microsoft's admin account guidance recommends at least two emergency access ("break glass") accounts that are not tied to a person and are used only when normal admins are locked out. Mandatory MFA for admin portals applies to these accounts too, so Microsoft suggests protecting them with a passkey (FIDO2) or certificate-based authentication. Keep the security keys in a safe and the details where two directors can reach them.

5. Tighten SharePoint and OneDrive sharing

In the SharePoint admin center, pick the least permissive external sharing level the business can work with: anyone with the link, new and existing guests, existing guests only, or only people in your organisation. Then set the default link type to specific people or people in your organisation, so wider sharing becomes a deliberate choice. If you keep "Anyone" links, make them expire and restrict them to view only. Microsoft's sharing settings guide explains each option.

6. Authenticate your email domain

Spoofed emails that look as if they come from your own domain, often asking for an urgent payment to a new bank account, are a common fraud pattern. Publish SPF, DKIM and DMARC records for every domain you send from, in that order. Microsoft's DMARC guidance recommends starting at p=none, moving to p=quarantine, and reaching p=reject once reports show your legitimate mail passes. Domains that never send mail can go straight to a reject policy.

7. Turn on preset email threat policies

Every plan includes built-in anti-malware, anti-spam and spoofing protection. Business Premium adds Defender for Office 365 Plan 1, with Safe Links, Safe Attachments and impersonation protection. Rather than tuning dozens of settings by hand, assign the Standard preset security policy to everyone and consider Strict for finance staff and directors, who receive the most targeted phishing.

8. Manage the devices that touch company data

Basic Mobility and Security, included in all plans, can require a PIN and wipe company data from a lost phone. Business Premium's Intune Plan 1 adds full device and app management, so you can require that laptops are encrypted and up to date before they reach company data. For staff on personal phones, app protection policies keep company data inside Outlook and Teams without taking over the whole phone.

9. Start data loss prevention with Malaysian identifiers

On Business Premium, Microsoft Purview DLP can warn or block when sensitive data leaves through email, SharePoint, OneDrive or Teams. Purview has a built-in Malaysia Identity Card Number type that matches the 12-digit MyKad pattern near keywords such as "mykad", "kad pengenalan malaysia" and "nric", plus a Malaysia passport number type. Start the policy in simulation mode, review the matches for two weeks, then show policy tips to users before you block anything.

10. Watch the logs and review Secure Score monthly

Confirm that audit logging is on, send alert notifications to a mailbox someone actually reads, and book 30 minutes a month to review Microsoft Secure Score in the Microsoft Defender portal. Each recommendation shows its impact and what users will notice, which makes it easy to choose the next change.

Where the Cyber Security Act 2024 applies

This section is general information, not legal advice. The Cyber Security Act 2024 (Act 854) came into operation on 26 August 2024, according to the National Cyber Security Agency's Act 854 page. Its core duties fall on national critical information infrastructure (NCII) entities in 11 sectors: government; banking and finance; transportation; defence and national security; information, communication and digital; healthcare services; water, sewerage and waste management; energy; agriculture and plantation; trade, industry and economy; and science, technology and innovation.

Being in one of those sectors is not enough on its own. An organisation becomes an NCII entity only when its NCII sector lead designates it under the Act. Designated entities must follow their sector's code of practice, carry out a cyber security risk assessment at least once a year and an audit at least once every two years, and report cyber security incidents within the short deadlines set in the incident notification regulations.

What that means for a typical SME:

• Most SMEs are not NCII entities, so the Act's duties do not apply to them directly. The baseline above is good practice, not a statutory checklist.
• Suppliers to NCII entities feel it anyway. Banks, hospitals and utilities pass security expectations down through contracts and vendor questionnaires. A documented baseline answers many of those questions.
• Buying security services? Under the Act and its licensing regulations, providers of managed security operation centre monitoring and penetration testing services need a licence from NACSA. Ask your provider about its licence status.
• The PDPA applies whatever your sector. Since 1 June 2025, data controllers must notify personal data breaches that cause or are likely to cause significant harm, so an incident involving customer data can have reporting duties even where the Cyber Security Act does not apply.

Building the skills in-house

In most SMEs one person owns Microsoft 365, often alongside other work. Security, Compliance and Identity Fundamentals (SC-900) gives that person and the managers around them a shared vocabulary, Endpoint Administrator (MD-102) covers Intune and device management, and Information Security Administrator (SC-401) covers Purview, sensitivity labels and DLP. If you were planning MS-102, note that Microsoft retires the MS-102 exam and the Microsoft 365 Administrator Expert certification on 30 November 2026; our guide on what Microsoft 365 admins should do next covers the options.

How CertTulen Academy can help

CertTulen Academy runs live, MCT-led training with hands-on labs, online or in person for corporate teams in Malaysia. SC-900 suits owners, managers and new admins. MD-102 and SC-401 suit the person who will configure devices and data protection. Professional certification courses include an exam voucher, mock practice tests and lab access; see each course page for details. CertTulen is an HRD Corp accredited training provider, and many of its professional courses can be claimed by HRD Corp registered employers; ask us which courses are claimable. Contact us or WhatsApp +60 16-241 8686.