What we found auditing GTA small-business Microsoft 365 setups

In October 2026 we carried out full Microsoft 365 security assessments for four small businesses in the Greater Toronto Area, in different industries. Three had between 10 and 25 accounts in their directory; the fourth was larger, with most of its accounts being shared mailboxes.

Each review was read-only. We looked at sign-in and MFA settings, administrator accounts, connected apps, mail and domain settings, file sharing, backup, devices, alerts and licences, and changed nothing. The four reports ran to between 39 and 66 findings each, 208 in all, and every one had at least three rated critical.

We also reviewed the public email settings of three more GTA business domains between July and October 2026. Those reviews only show what anyone on the internet can see, so we use them for the email authentication numbers and nothing else.

Four businesses is a small group, and they came to us because they wanted someone to look, so they are not a random sample. Read the counts as patterns we keep seeing, not as a survey of every business in Ontario.

None of the four required multi-factor authentication for all users. Across the four, 117 of 121 directory accounts could be opened with a password alone. None had security defaults or Conditional Access turned on, and two of the four were already paying for the licence that includes Conditional Access.

A stolen or guessed password is all it takes to get into a mailbox like that. Requiring MFA is the single change that stops most of these break-ins.

Every business had at least one Global Administrator account without MFA. None had an emergency (break-glass) admin account set aside in case the main one is lost or locked. In three of the four, a Global Administrator account was also someone's everyday mailbox, which means it is the account that reads every phishing email.

A Global Administrator can read every mailbox, change every setting and lock everyone else out. That account should be used rarely, protected heavily and never used for daily email.

In all three businesses whose licences keep sign-in logs, we saw automated password guessing every day. The fourth kept no sign-in logs, so nobody could tell who had signed in from where. In two of the four we found signs of a mailbox takeover, either live or in the past.

This is not targeted hacking. It is constant and automated, and with no MFA it only has to work once.

None of the four had a backup of their Microsoft 365 mail and files. Across the three that showed a total, that was about 4 TB of data with no second copy. In all four, deleted mail was kept for only 14 days and there was no retention policy.

If a mailbox is wiped, files are encrypted or a departing employee's account is deleted, there may be nothing to restore after a couple of weeks.

All four allowed Anyone links with edit rights. Across three of them we counted more than 450 live Anyone links, and in every one of the four we found such links on financial or HR files.

An Anyone link works for whoever holds it, with no sign-in. Forward it once and you have lost control of that file.

In all four, Microsoft's security alerts and notices went to a mailbox nobody watches, to an address that no longer exists, or to a former provider. The alarm was wired up, but it rang in an empty room.

In all four, any user could approve a third-party app's access to their mailbox or files without an administrator checking. All four also had apps still connected with far more access than they needed.

Approving a convincing "sign in with Microsoft" prompt can give an outsider lasting access to mail. Our guide to OAuth app consent controls covers how to lock this down.

Across all seven domains, only one had DMARC set to quarantine or reject fake mail, and none were at reject. Four were set to monitor only and two had no DMARC record at all. DKIM signing was confirmed working on only one, and two had SPF missing or broken.

Without SPF, DKIM and DMARC working together, anyone can send an email that looks like it came from your domain. That is how fake invoices and changed banking details reach your clients. Our larger DNS scan of GTA business domains found the same pattern at scale.

All four still had the older POP and IMAP mail protocols open, none blocked legacy sign-in, and all four left Direct Send unblocked, which lets outsiders drop mail into staff inboxes that appears to come from a company address.

All four were paying for licences that were unused or did not match how people work. Defender for Office 365 was licensed and applied correctly in only one of the four: in the others it had been bought but applied to nobody, licensed for a few people but applied to everyone, or allowed to lapse.

The good news: all four had the Microsoft 365 unified audit log and mailbox auditing turned on, so there was a record to investigate. Check that yours is on too.

1. 01

   Require MFA for every account

   Start with administrators. If you have nothing else in place, turn on security defaults today.

2. 02

   Separate the admin accounts

   Give the Global Administrator role to admin-only accounts, never to someone's daily mailbox, and keep the number small.

3. 03

   Create one emergency admin account

   A long password, stored offline, used only if the normal admin accounts are unavailable.

4. 04

   Close the old doors

   Turn off POP and IMAP unless something truly needs them, and block legacy sign-in.

5. 05

   Back up mail, OneDrive and SharePoint

   Then test a restore. See our Microsoft 365 backup guide.

6. 06

   Set a retention policy

   Decide how long mail and files are kept, rather than relying on the 14-day default for deleted mail.

7. 07

   Clean up Anyone links

   Find and remove them on sensitive files, then make new links view-only with an expiry date.

8. 08

   Send alerts to a person

   Point security alerts at a mailbox someone checks every day.

9. 09

   Require admin approval for apps

   Then remove app connections nobody can explain.

10. 10

    Publish SPF, turn on DKIM, set up DMARC

    Start DMARC at monitor with a report address, then move to quarantine and reject once your real mail passes. See our DMARC rollout guide.

Sample: four full Microsoft 365 tenant assessments carried out in October 2026 for GTA small businesses that asked for a review, plus outside-only reviews of three more GTA business domains' public DNS between July and October 2026. All reviews were read-only.

Counting: each figure counts tenants or domains where the final report states the condition. Where a report does not state something, we left it out of the count rather than assume it. Figures such as the 117 of 121 accounts include shared mailboxes. The sample is small and self-selected, so it describes what we found, not the share of all GTA businesses with each gap.

Privacy: no client names, industries, sizes or details that could identify a business are published. The aggregate figures are available as a CSV file.

Reuse: CC BY 4.0. The figures in this article may be reused with credit to IT Rapid Support Inc. and a link to this page.