11 min read
Adrian Ghira
:
August 13, 2026
A Calgary manufacturing firm forwarded us a story last quarter. Their CFO received an email that appeared to be from their CEO asking for an urgent wire transfer to complete an acquisition. The email came from a lookalike domain (a single-character variant of their real domain), landed in the CFO's inbox with no warning banner, no external-sender label, and no anti-impersonation flag. The CFO called the CEO to confirm thankfully and the fraud was avoided. But their Microsoft 365 environment let a well-crafted impersonation attempt reach the C-suite with zero friction.
The 2026 Verizon Data Breach Investigations Report confirms Business Email Compromise (BEC) as the most damaging non-ransomware attack against SMBs, with a median loss of $50,000 per incident. Microsoft's own Digital Defense Report identifies email as the #1 initial access vector for both credential theft and ransomware deployment. And yet the majority of Canadian SMBs run Microsoft 365 with default settings settings that Microsoft designed for backwards compatibility across every customer in the world, not for the specific threat environment facing a 20-to-200 user Canadian business in 2026.
Default Microsoft 365 is not insecure it's under-secured for the current threat landscape. Microsoft ships M365 with the settings that will work for the widest set of tenants: legacy authentication enabled for older devices, permissive external sharing on OneDrive and SharePoint, no enforced MFA on standard licenses, and no anti-phishing intelligence beyond basic spam filtering. Each of those defaults is a rational choice for Microsoft. Each of those defaults is a real vulnerability for your Canadian SMB.
The 2026 Mandiant M-Trends report noted that misconfigured Microsoft 365 tenants remain among the top three initial access vectors not because Microsoft's security controls don't work, but because most tenants don't have those controls enabled. Attackers know this. Every Canadian SMB tenant running default configurations is running a known-vulnerable environment.
GAM Tech has hardened Microsoft 365 tenants for Canadian SMBs across Calgary, Edmonton, Vancouver, Toronto, Ottawa, and Montréal since 2012. What follows is our standard hardening checklist the 12 settings that separate a default M365 tenant from a defensible one. Each setting is available in either the Microsoft 365 Business Premium or E3/E5 license tier that most SMBs already pay for. This is not about buying more Microsoft it is about turning on what you already own.
Microsoft's own data shows that MFA blocks 99.2% of automated account compromise attempts. Yet the single most common gap we find on Canadian SMB M365 audits is MFA that's enabled for some users but not others usually with an executive or IT administrator on the exception list because 'they travel a lot' or 'their MFA broke once.' That single unprotected account is what attackers hunt for.
GAM Tech's baseline: MFA enforced on 100% of user accounts, including guest accounts. Preferred method: authenticator app (Microsoft Authenticator, Duo) with number-matching. SMS-based MFA is a fallback only, not the default SIM-swap attacks against Canadian mobile carriers are a documented threat.
Legacy authentication protocols (POP, IMAP, older SMTP AUTH) don't support MFA. Every legacy authentication endpoint in your tenant is a bypass around the MFA you just enforced. Microsoft has been deprecating basic authentication since 2022, but many tenants still have legacy protocols enabled for older applications or scan-to-email printers.
Action: enable the 'Block Legacy Authentication' policy in Entra ID. Audit exceptions carefully every exception is a security exposure.
Conditional Access is the single most powerful security control in Microsoft 365, and the least used by SMBs. Recommended baseline policies:
Require MFA for all users (redundant to Setting 1, but a defense-in-depth backstop).
Block sign-ins from countries where you don't operate (typically block all except Canada, US, and specific trusted countries where staff travel).
Require compliant device for admin roles (Global Admin, Privileged Role Admin, Security Admin).
Require MFA + password change on high-risk sign-ins (Entra ID Protection risk signal).
Block risky users automatically (Entra ID Protection high-risk user detection).
Global Administrator accounts should not be permanent every admin should activate their elevated role only when needed, with time-limited access and approval workflows. Entra ID Privileged Identity Management (PIM) makes this straightforward and is included in M365 Business Premium and above. Standing admin rights are a phishing target; JIT admin access dramatically reduces the blast radius of a compromised administrator credential.
Defender for Office 365 (included in M365 Business Premium and E5) has anti-phishing policies that go far beyond spam filtering. Baseline configuration:
Enable Impersonation Protection for all senior executives and the finance team (specify by email address, not just by display name).
Enable Domain Impersonation Protection for your own domain and any lookalike domains you've registered defensively.
Set the Anti-Phishing Advanced Threshold to 'Aggressive' (level 2) for SMBs the default 'Standard' is too permissive for the current BEC threat landscape.
Enable Mailbox Intelligence and Mailbox Intelligence-based Impersonation Protection these use behavioural signals to catch impersonation attempts that pass technical checks.
These three email authentication protocols are your public statement to the world about which servers can legitimately send email on behalf of your domain and they're free. But the average Canadian SMB M365 tenant has: SPF partially configured, DKIM disabled, and DMARC in monitor-only mode ('p=none'). Attackers use tenants in this state to spoof mail from your domain against your own customers.
Baseline: DKIM enabled for every sending domain, SPF hard-fails ('-all') for every domain, DMARC at 'p=quarantine' minimum (target 'p=reject' within 6 months of monitor-only baseline).
Safe Links (URL rewriting with time-of-click scanning) and Safe Attachments (sandbox detonation before delivery) are Defender for Office 365 features that catch a significant percentage of phishing links and malware attachments that got past static filters. Both should be enabled with:
Safe Links: track clicks, do not allow users to click through the warning page for known-malicious URLs.
Safe Attachments: 'Dynamic Delivery' preview mode so users receive email quickly while the attachment scans in parallel.
Safe Links for internal senders too insider-account compromise is real, and Safe Links catches phishing links sent from within your tenant.
Every email from outside your tenant should be tagged with a clearly visible banner ('This message came from outside your organization. Verify the sender before clicking links or opening attachments.'). This single control catches an enormous percentage of impersonation attempts including the 'CEO wire transfer' scenario from the opening of this post. Configure via transport rules with HTML injection at the top of the message body.
Default OneDrive and SharePoint allow external sharing with anyone, including anonymous 'anyone with the link' access. For most Canadian SMBs especially in regulated industries (healthcare, legal, financial services) this is inappropriate. Baseline:
Default sharing setting: 'Specific people' (must sign in with a real account).
'Anyone with the link' disabled tenant-wide.
Guest access requires MFA (via Conditional Access).
External sharing expires automatically after 90 days by default.
External sharing is logged and alertable via Purview.
Sensitivity labels let you classify documents (Confidential, Client Confidential, Internal Only, etc.) and enforce protection policies (encryption, restricted forwarding, watermarking) that follow the file wherever it goes. For Canadian SMBs handling regulated data (PIPEDA, PHI, financial records, legal documents), this is now a baseline expectation from cyber insurance underwriters. Sensitivity labels are included in M365 Business Premium.
Microsoft 365 has audit logging capabilities that cover every meaningful user action across Exchange, SharePoint, OneDrive, Teams, and Entra ID. Enable Purview Audit (Standard or Premium depending on license). Retain audit logs for at least 1 year for standard SMBs; longer for regulated industries. This is the difference between 'we think a former employee took client data' and 'we can prove exactly what they accessed and when.'
This is the single most misunderstood aspect of Microsoft 365. Microsoft's Service Level Agreement covers infrastructure availability, not data loss protection. If a user deletes a mailbox item and empties the deleted items folder, if a ransomware attack encrypts SharePoint files through a compromised user account, or if an admin misconfigures a retention policy Microsoft's default settings do not protect you.
Baseline: third-party M365 backup solution (Veeam Data Cloud, Datto SaaS Protection, Barracuda Cloud-to-Cloud Backup, or similar) with independent retention policies covering Exchange, OneDrive, SharePoint, and Teams. Retention: 7 years for most SMBs; longer for regulated industries. Immutable backup storage (backups that can't be encrypted or deleted from a compromised M365 admin account) is the current best practice.
Canadian SMBs running Microsoft 365 need to consider several regulatory dimensions:
Data residency: Microsoft 365 offers Canadian data residency for core services (Exchange, SharePoint, OneDrive, Teams). Confirm your tenant is provisioned in a Canadian region if data residency is a regulatory or contractual requirement.
PIPEDA breach notification: a breach of your M365 tenant that exposes personal information triggers PIPEDA notification obligations regardless of Microsoft's own SLA.
Provincial privacy laws: Quebec Law 25 (effective 2023-2024 in phased rollout) imposes additional obligations on organizations handling Quebec residents' personal information, including through cloud platforms.
Regulated industry requirements: healthcare (PHIPA, HIA), legal (Law Society technology guidance), and financial services all impose additional Microsoft 365 configuration expectations.
GAM Tech configures every Canadian SMB M365 tenant with data residency in Canada, appropriate retention policies for the client's regulatory environment, and provincial-privacy-law-aware sharing and access controls.
GAM Tech (GAM Technical Services Inc.) is a Microsoft Partner supporting Canadian SMBs from 8 offices across Alberta (Calgary HQ, Edmonton, Red Deer), British Columbia (Vancouver, Victoria), Ontario (Toronto, Ottawa), and Quebec (Montréal) since 2012. Bilingual English and French support in Ottawa and Montréal.
SOC 2 certified and Certified B Corporation. Ranked #97 globally / #1 in Western Canada on the 2026 MSP 501. Named to Canada's Top 50 Best Managed IT Companies for five consecutive years (2021-2025). ESET Canada MSP Partner of the Year 2024 and 2025. Great Place to Work-Certified Top 100 Best Workplaces in Canada.
Microsoft 365 security hardening is included as part of our Managed IT plans we do not charge separately for the initial 12-point hardening pass, the Conditional Access policy design, the Defender for Office 365 configuration, or the DKIM/SPF/DMARC deployment. Every Managed IT plan includes 24/7/365 support with a 5-minute response commitment delivered on 99%+ of tickets, a named Client Success Manager for strategic guidance, and a dedicated 24/7 help desk team for day-to-day issues.
Silver plans start at $110 per managed device per month with a $1,000 monthly minimum priced per device (computer, server, or network device), not per user. Gold plans add the layered cybersecurity stack (MDR managed 24/7 detection & response, XDR cross-domain, ITDR identity threat detection, security awareness training plus ongoing phishing simulations, immutable off-site backups, Breach Recovery Guarantee) that most cyber insurance underwriters now require.
Professional services on the majority of IT projects Microsoft 365 migrations, security assessments, Conditional Access rollouts, tenant-to-tenant merges are included in the plan with no separate project fees.
Microsoft 365 Business Standard includes the productivity apps (Outlook, Word, Excel, PowerPoint, Teams, SharePoint, OneDrive) and basic email. Microsoft 365 Business Premium adds the security and management capabilities most SMBs actually need: Entra ID Plan 1 with Conditional Access, Intune for device management, Defender for Office 365 for anti-phishing and malware sandboxing, Defender for Business for endpoint protection, and Purview Information Protection. For any Canadian SMB handling regulated data or with cyber insurance requirements, Business Premium is the practical minimum.
GAM Tech includes the standard 12-point hardening in all Managed IT plans at no separate project fee. What you pay for is the ongoing monitoring, alerting, and response starting at $110 per managed device per month with a $1,000 monthly minimum on Silver plans. Gold plans add MDR monitoring and the broader cybersecurity stack. Contact GAM Tech for pricing specific to your tenant size.
No — this is the single most common misconception among Canadian SMBs running M365. Microsoft's SLA covers infrastructure availability, not data recovery. If a user permanently deletes a mailbox item, if ransomware encrypts SharePoint files through a compromised account, or if an admin misconfigures retention policies, Microsoft's defaults do not restore that data reliably. Every Canadian SMB running M365 should have a third-party backup solution (Veeam, Datto, Barracuda, or equivalent) with immutable storage and independent retention.
Conditional Access is Microsoft's policy engine for controlling who can access what, from where, on which device, with what level of authentication. Baseline SMB Conditional Access policies include: require MFA for all users, block sign-ins from countries where you don't operate, require compliant devices for administrators, and block risky sign-ins automatically. Conditional Access is included in Entra ID Plan 1 (part of M365 Business Premium).
SPF (Sender Policy Framework) declares which mail servers can send email on behalf of your domain. DKIM (DomainKeys Identified Mail) cryptographically signs your outbound email so recipients can verify it hasn't been altered. DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells recipient servers what to do when SPF or DKIM checks fail. All three are free to configure and together they prevent attackers from spoofing email from your domain. Canadian SMBs without DKIM and enforced DMARC are effectively giving BEC attackers permission to impersonate their brand.
Defender for Office 365 provides Safe Links (time-of-click URL scanning), Safe Attachments (sandbox detonation), anti-phishing with impersonation protection, and threat investigation tooling. It's included in M365 Business Premium and E5. For any Canadian SMB with senior executives, finance staff, or high-value client relationships, Defender for Office 365 catches a meaningful percentage of the phishing and BEC attempts that get past standard spam filtering. The license premium is minor relative to the average cost of a single successful BEC incident.
Microsoft 365 offers Canadian data residency for core Exchange, SharePoint, OneDrive, and Teams data but only if your tenant is provisioned in a Canadian region and you have appropriate license and configuration. Some services (Teams meeting content, certain compliance features, and some third-party integrations) may transit or be processed outside Canada. If Canadian data residency is a hard regulatory or contractual requirement, verify the specific service coverage with your Microsoft Partner. GAM Tech provisions all Canadian SMB tenants with Canadian data residency by default.
Trusting the defaults. Microsoft 365's out-of-the-box configuration is designed for backwards compatibility across every customer worldwide not for the current threat environment facing a Canadian SMB. Legacy authentication is often enabled, MFA is not enforced, Conditional Access policies are not configured, Defender for Office 365 is not deployed, and DKIM is not enabled. Every one of those defaults is a rational choice for Microsoft and a real vulnerability for your business.
Continuously. Microsoft ships new security features and updates to existing ones on an ongoing basis, threat intelligence updates change what 'baseline' means, and new attack techniques target specific M365 configurations. GAM Tech's Managed IT clients receive quarterly M365 security reviews as part of their Client Success Manager engagement, with ad-hoc reviews when Microsoft publishes major security guidance or when we detect new attack patterns against Canadian SMB tenants.
In order of impact: enforce MFA on 100% of users (blocks 99% of automated account compromise), block legacy authentication (removes the MFA bypass), enable Defender for Office 365 anti-phishing with impersonation protection (catches BEC), deploy DKIM and DMARC (prevents domain spoofing), and configure Conditional Access baseline policies (adds contextual protection). These five steps close the majority of the gap between default M365 and defensible M365 and can typically be completed in a single engagement.
For most Canadian SMBs, Microsoft 365 Business Premium is the practical minimum it includes all the security capabilities discussed in this article. Business Standard is too limited for the current threat environment. For SMBs in regulated industries (healthcare, legal, financial services) or with 300+ users, Microsoft 365 E3 or E5 offers additional Purview compliance tooling and Defender for Endpoint Plan 2 that may be worth the license premium. GAM Tech advises on licensing as part of the standard Managed IT engagement.
Microsoft 365 defaults are not secure enough for a Canadian SMB in 2026. That's not a criticism of Microsoft it's a recognition that Microsoft ships settings for backwards compatibility across every customer, and the current threat environment demands more than backwards compatibility. Every one of the 12 settings in this guide is included in the Microsoft 365 Business Premium or E3 license most SMBs already pay for.
GAM Tech hardens Microsoft 365 tenants for Canadian SMBs as part of every Managed IT engagement no separate project fee, no per-user configuration charge, no upcharge for the 12-point baseline. Every client gets a named Client Success Manager who reviews the tenant quarterly, adjusts policies as Microsoft ships new features, and coordinates with your cyber insurance underwriter on control demonstrations.
Contact GAM Tech to discuss the specific Microsoft 365 hardening requirements of your business. Call toll-free 1-833-GAM-TECH (1-833-426-8324) or book a free 30-minute consultation at gamtech.ca/book-a-consultation. We serve Canadian SMBs from 8 offices Calgary, Edmonton, Red Deer, Vancouver, Victoria, Toronto, Ottawa, and Montréal with bilingual English and French support in Ottawa and Montréal.
-2.png)
1 min read
GAM Tech Team : Aug 21, 2023, 9:00:00 AM
In today’s hyper-connected world, businesses rely heavily on technology to drive growth, enhance productivity, and deliver exceptional customer...
1 min read
Adrian Ghira : May 7, 2026, 10:00:00 AM
Two years after Microsoft launched Copilot for Microsoft 365, most Canadian small and mid-sized businesses are still asking the same three questions:...
1 min read
Adrian Ghira : Mar 25, 2024, 9:35:18 AM
In today's digitally-driven landscape, small and medium-sized businesses (SMBs) are increasingly becoming prime targets for cyber threats. Despite...
