Turn on MFA for Microsoft 365 — it's the single biggest win

Multi-factor authentication stops the vast majority of account takeovers, because a stolen password alone is no longer enough. In Microsoft 365, an admin turns it on via security defaults (Microsoft Entra admin centre > Properties > Manage security defaults) or, better, a Conditional Access policy — roll it out to admins first, then everyone.

Use an authenticator app (Microsoft Authenticator) rather than SMS where you can, since texts can be intercepted. Coach's tip: give staff a week's notice and a one-page guide so day one isn't chaos.