Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallStart with identity: make sure every user and administrator must use multifactor authentication (MFA), and block legacy authentication where possible. For many small businesses, Microsoft Entra security defaults provide the simplest baseline. Next, limit and protect administrator accounts, review email protections, secure every device that accesses company data, and use Microsoft Secure Score to help choose follow-up actions.
1. Require MFA and block legacy authentication
Begin by checking whether your tenant uses Microsoft Entra security defaults or equivalent Conditional Access policies. Microsoft’s security defaults require users and administrators to register for MFA, require MFA for them, block older authentication protocols that cannot use MFA, and require MFA for Azure management access. Microsoft says MFA can block over 99.2% of identity-based attacks; that is Microsoft’s published figure, not a guarantee for an individual business.
As an Amazon Associate I earn from qualifying purchases.
Security defaults are a practical baseline for many organizations and do not require an Entra ID P1 license. Conditional Access offers more customization but requires at least Entra ID P1. Microsoft’s documentation also says new and existing tenants no longer receive the 14-day grace period for users to register for MFA as of July 29, 2024.
Choose a baseline that fits your tenant
| Option | When it fits | License and trade-off | Watch for |
|---|---|---|---|
| Security defaults | A small organization that wants a straightforward baseline | Available without Entra ID P1; less customizable | Legacy applications, devices, or device-code sign-ins may be affected |
| Conditional Access | A business that needs tailored access requirements or exclusions | Requires at least Entra ID P1; offers customization | Recreate the baseline protections before turning off security defaults |
Before enabling or changing policies, identify older apps, multifunction devices, and sign-in flows that may depend on legacy authentication. Do not disable security defaults until replacement policies are ready and cover the protections you need.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
How to turn on MFA for Microsoft 365
For a simple tenant-wide baseline, open the Microsoft Entra admin center and go to Identity > Overview > Properties > Manage security defaults, then set security defaults to enabled and save. Portal labels may change; verify the current tenant behavior and test the sign-in experience. If the business needs custom rules, use Conditional Access only when the tenant has the required Entra ID P1 entitlement, and build the replacement policies before disabling defaults.
2. Reduce and protect administrator access
MFA is only one part of admin security. Keep the number of administrator accounts small, grant only the roles and privileges people need, and use ordinary accounts for email and routine work rather than using an admin account day to day.
- Maintain at least two emergency access accounts, reserved for emergencies, as Microsoft recommends.
- Consider passwordless sign-in for administrators. Microsoft’s listed options include Microsoft Authenticator, FIDO2 passkeys, and Windows Hello for Business.
- Check device and sign-in compatibility before choosing a FIDO2 security key; Microsoft’s guidance does not endorse a particular retail model.
Business Premium, through Entra P1, adds Conditional Access controls for passwordless authentication strength. Confirm the tenant’s licenses and available controls before planning around them.
Recommended Free Tools
3. Review email protection without creating broad exceptions
Cloud mailboxes automatically receive malware and high-confidence phishing quarantine protections. Microsoft describes this as protection all organizations with cloud mailboxes receive. Review the policies in use rather than assuming every additional email control is included in every Microsoft 365 plan.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Microsoft associates impersonation protection, Safe Links, and Safe Attachments with Defender for Office 365 Plan 1 in Business Premium. Check the tenant’s actual entitlement and policy configuration. Avoid broad allowlists as a quick fix for false positives: Microsoft documents limits on overrides for malware and high-confidence phishing.
4. Protect every device that accesses company data
First inventory company-owned and personal devices that can reach business data. Then check which management and endpoint controls are available in your subscription. Microsoft’s plan comparison lists Basic Mobility and Security broadly, while Intune and Defender for Business device policies are associated with Business Premium.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Defender for Business policy areas include next-generation protection, firewall, and attack surface reduction. If you move device-policy management from Intune to the Defender portal, check for overlapping policy sources and conflicts rather than applying duplicate settings blindly.
Free tools Windows power users keep installed
One-click scans. No signup required.
5. Use Secure Score to prioritize the next work
Review recommended actions in Microsoft Secure Score and use them to build a practical action plan. MFA coverage and blocking legacy authentication are among the actions it tracks. Secure Score can help monitor posture, but Microsoft’s guidance says its recommendations do not cover every attack surface; a high score is not a security guarantee or a complete risk assessment.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check plan entitlements before configuring controls
Microsoft’s business security guidance is aimed at small and medium-sized businesses with up to 300 users and compares Business Basic, Business Standard, and Business Premium. Capabilities differ by subscription: security defaults are presented as suitable for most organizations across these tiers, while Conditional Access, Defender for Office 365 Plan 1, and more extensive device protection are associated with Premium in Microsoft’s comparison. Confirm the licenses actually assigned in your tenant before following plan-specific configuration steps.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
