By Eagle Tech Corp | 5 min read
Churches can secure Microsoft 365 accounts by implementing five essential controls: multifactor authentication, role-based access, email protection, secure file sharing, and ongoing account reviews. For a church with 25–50 employees and rotating volunteers, these measures help protect donor information, ministry communications, and confidential records. Start by enabling multifactor authentication for every account, reviewing who has administrative access, and establishing a process to remove access when someone leaves a ministry role.
1. Require Multifactor Authentication for Every Account
Multifactor authentication (MFA) adds another verification step beyond a password, making unauthorized access more difficult.
Churches should require MFA for staff, ministry leaders, finance personnel, and volunteers with Microsoft 365 accounts.
Prioritize these actions:
- Enable MFA: Protect all accounts, especially those with administrative privileges.
- Use stronger authentication: Prefer phishing-resistant methods, such as passkeys or security keys, where practical.
- Protect account recovery: Keep recovery information current and secure.
- Eliminate shared logins: Give each authorized person an individual account.
- Review administrator roles: Limit privileged access to people who genuinely need it.
A shared password for several ministry volunteers makes it difficult to determine who accessed or changed information.
Practical recommendation: Aim for 100% MFA coverage across eligible Microsoft 365 accounts and review exceptions promptly.
2. Control What Staff and Volunteers Can Access
Not everyone serving at a church needs access to the same information.
A children's ministry volunteer may need a schedule and approved documents but should not automatically have access to payroll records or donor reports.
Use the principle of least privilege: provide only the permissions necessary for each role.
A practical approach includes:
- Define access requirements for each ministry position.
- Assign permissions through appropriate Microsoft 365 groups.
- Restrict confidential SharePoint sites and files.
- Limit administrative privileges.
- Remove access when responsibilities change.
Review sensitive permissions at least every six months, with immediate updates when staff or volunteers leave.
For churches using outside contractors or guest collaborators, establish expiration dates and periodic access reviews where supported.
3. Protect Church Email Against Phishing and Impersonation
Church email accounts are attractive targets because staff regularly communicate about donations, invoices, pastoral activities, and financial approvals.
Attackers may impersonate pastors or finance directors to request gift cards, banking changes, or sensitive information.
Microsoft 365 security planning should include:
Anti-phishing protection: Configure available protections against malicious links, attachments, and impersonation attempts.
Domain authentication: Review SPF, DKIM, and DMARC settings to reduce unauthorized use of your church's email domain.
Suspicious sign-in monitoring: Investigate unusual access attempts and unexpected mailbox forwarding rules.
Payment verification: Require independent confirmation before changing banking instructions or releasing unusual payments.
Staff awareness: Teach employees and volunteers to report suspicious messages without interacting with them.
For a deeper explanation of ministry-specific fraud, see our guide on How a Church Can Protect Itself From Pastor Impersonation Scams.
4. Secure SharePoint, OneDrive, and Teams
Microsoft 365 makes collaboration easier, but poorly configured sharing permissions can expose confidential church information.
Churches should establish clear rules for storing and sharing documents.
SharePoint: Organize ministry documents by department or responsibility, restricting access to sensitive areas.
OneDrive: Use organization-managed accounts for church business rather than personal cloud storage.
Microsoft Teams: Review membership, guest access, and the information shared in ministry channels.
External Sharing: Limit anonymous links and use expiration dates or authenticated access when appropriate.
Sensitive Records: Apply additional controls to donor reports, employee files, and confidential pastoral information.
For especially sensitive counseling information, assess whether Microsoft 365 is the appropriate storage environment and what legal, confidentiality, and retention requirements apply.
Practical recommendation: Review external sharing settings quarterly and remove links that are no longer necessary.
5. Establish Account Reviews, Backups, and Recovery Procedures
Microsoft 365 security requires ongoing management—not a one-time setup.
Create a documented schedule for checking account activity, permissions, and recovery readiness.
Monthly: Review security alerts, inactive accounts, and unresolved access issues.
Quarterly: Review external sharing, administrator privileges, and account security settings.
Every six months: Reconfirm access to sensitive ministry information.
Annually: Test documented recovery procedures and reassess the church's security policies.
Churches should understand the retention and recovery capabilities included in their Microsoft 365 subscriptions and evaluate whether additional backup services are needed.
Your managed IT provider should also document who responds to account compromises, how incidents are escalated, and which support services are included.
For a broader security checklist, read What Cybersecurity Services Does a Church Need to Protect Donor and Member Information?.
Practical Example: A Church With 35 Employees
Consider a church with 35 employees, 15 volunteers who use Microsoft 365, and separate teams managing finance, children's ministry, and worship planning.
Leadership discovers that some volunteers share passwords, former staff retain access, and confidential documents have overly broad sharing permissions.
A 30-day improvement plan could prioritize individual accounts, MFA, permission reviews, and safer document sharing.
Example for illustration purposes only.
Frequently Asked Questions
1. Should church volunteers use Microsoft 365 accounts?
Volunteers who need ongoing access to church systems should use appropriately managed identities rather than shared staff passwords. Licensing and access requirements depend on their roles.
2. Is MFA necessary for a small church?
Yes. MFA is an important safeguard regardless of church size because compromised accounts can expose email, documents, and ministry information.
3. Can churches share Microsoft 365 files with outside volunteers?
Yes, using appropriately configured guest access or sharing controls. Permissions should be limited to the information required.
4. Does Microsoft 365 automatically back up everything?
Microsoft 365 includes various retention and recovery capabilities, but they differ by service, configuration, and license. Churches should evaluate whether additional backups are necessary.
5. How often should churches review Microsoft 365 permissions?
Review sensitive access at least every six months, external sharing quarterly, and accounts immediately when someone leaves a role.
6. Can Eagle Tech Corp manage Microsoft 365 for churches?
Eagle Tech Corp provides fully managed and co-managed IT services for churches in Washington, DC, Maryland, and Virginia, including bilingual English and Spanish support.
Protect Your Church's Microsoft 365 Environment
Microsoft 365 can support secure communication and collaboration when accounts, permissions, and sharing settings are managed carefully.
By following these five steps, churches can reduce avoidable risks while making technology easier for staff and volunteers to use responsibly.
Ready to strengthen your church's Microsoft 365 security?
Contact Eagle Tech Corp to discuss your ministry's cybersecurity needs and explore managed IT support designed for churches and faith-based organizations.
