How to check if your Microsoft 365 tenant is exposed to email impersonation

Business Email Compromise (BEC) is the most expensive cybercrime in Ireland and the UK right now. The 2025 IBM Cost of a Data Breach Report put the average BEC incident at €4.5M when the wire transfer lands. The mechanics are unglamorous: a finance person gets an email that looks like it's from the CEO or a known supplier, asking to change bank details on a pending payment. It works because most Microsoft 365 tenants have at least three of the five gaps below.

1. Is SPF on ~all instead of -all?

Run dig TXT yourdomain.com (or use mxtoolbox.com). Look at the SPF record. If it ends in ~all (softfail), receivers are told to accept but mark spoofed mail. If it ends in -all (hardfail), receivers are told to reject spoofed mail. Hardfail is what you want, but only after step 2 below.

2. Is DKIM signing on every sender?

Open the Microsoft 365 Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Confirm both selectors are enabled for every accepted domain. Then think about every other service that sends as you — Mailchimp, Stripe, your CRM, your invoicing tool, your booking engine. Each needs its own DKIM selector signed with your domain. If even one isn't, moving DMARC to p=reject will break it.

3. Is DMARC at p=none?

p=none means receivers ignore your DMARC policy entirely. It's where everyone starts but staying there for years tells attackers your domain is unprotected. The progression is: p=none (monitoring only) → p=quarantine (suspicious mail to junk) → p=reject (suspicious mail bounced). Most tenants we audit have sat on p=none for 3+ years.

4. Is Defender impersonation protection on for board/finance/IT?

Defender for Office 365 Plan 2 (included in Microsoft 365 Business Premium and E5) has a user-impersonation policy that catches display-name spoofing — the most common BEC pattern. Open Defender → Anti-phishing policies → check whether your CEO, CFO, IT lead and at least one finance contact are listed as 'protected users'. In 80% of the tenants we audit, this list is empty.

5. Is MFA on every account?

Not 'most accounts'. Every account. Especially shared mailboxes that finance/accounts/sales use. Especially break-glass admin accounts. Especially the dormant account belonging to the contractor who left in March 2023. Open Microsoft Entra → Users → Per-user MFA → sort by 'Multi-factor auth status'. Any account showing 'Disabled' is one phishing click from being yours-no-more.

What to do next

If any of these five made you wince: book the free Intellix external review. We run all five checks plus another twenty in 48 hours, no tenant access required. PDF brief to your inbox. Request the free review.