Plenty of good small firms run Microsoft 365 with nobody really looking after it. The owner set it up, or a staff member who is handy did, and it has worked fine since. The trouble is that "working fine" and "secure" are not the same thing, and the gap only shows up the day something goes wrong. Here is how to think about it when there is no IT person in the building.
Why no IT team is the risky bit
Attackers do not skip small firms, they prefer them, because the tools are there but nobody has turned the security on. Microsoft 365 is secure enough if configured, and wide open if not, and the default setup leans towards easy, not safe. With no one whose job is to check, the holes just sit there quietly until a password leaks or someone clicks the wrong link.
The handful of things that actually matter
You do not need to become an expert. Most real risk comes down to a short list. MFA on for everyone with no exceptions. Legacy sign in methods blocked. Laptops encrypted and kept patched. Admin accounts locked down with a break glass account in reserve. Leavers properly shut off. Get those right and you have closed the doors that almost every small firm breach walks through.
Why the defaults are not enough
Microsoft ships sensible defaults now, and they help, but they are a floor, not a finish. They do not enforce everything, they do not match your business, and they do not tell you what is still open. Security Defaults being on is not the same as being hardened. The difference is the bit a person has to do and keep doing.
What to do about it
Two honest options. Learn the list above and work through it yourself, which is doable if you have the time and patience. Or have someone set it up once properly and keep an eye on it, so it is not riding on whoever is least busy that week. Either way the goal is the same, the few things that matter done and kept done. That is the whole of it, and it is exactly what a Health Check and then Managed Intune cover.