Email is the most widely used business application—and the No. 1 vector of cyberattacks. For Microsoft’s enormous installed base of Microsoft 365 Exchange email users, the cyber threat is particularly acute. This paper explores the security challenges facing organisations that rely on Microsoft 365 for email and provides recommendations designed to mitigate these risks.