Microsoft 365 security checklist for small businesses

Sign-in

• MFA for every account. Without Entra ID P1 licences, Security Defaults is the simplest way to turn it on. With Microsoft 365 Business Premium or Entra ID P1, use Conditional Access policies instead (the two can’t be on at the same time).
• Block legacy authentication (POP, IMAP, SMTP AUTH, very old Office clients). These protocols can’t do MFA, so a leaked password is enough. Security Defaults blocks them; with Conditional Access it is one policy.
• Prefer the authenticator app or passkeys over text-message codes, which can be intercepted or redirected.
• Self-service password reset, so people reset their own password with MFA instead of asking someone to do it by e-mail or phone.

Admin accounts

• Few Global Administrators. Microsoft recommends fewer than five. For daily work, use the specific roles (User, Exchange, Helpdesk administrator).
• Separate admin accounts, not the account people use to read e-mail and browse.
• Two emergency (“break-glass”) accounts: cloud-only, protected with phishing-resistant MFA such as a FIDO2 key, kept out of Conditional Access policies that could lock everyone out, and with an alert when they sign in.

E-mail

• SPF, DKIM and DMARC for every domain you send from. Start DMARC at p=none to read the reports, then move to quarantine or reject.
• Block automatic forwarding to outside addresses (in the outbound spam policy). Attackers who get into a mailbox often set a forwarding rule to keep reading it.
• Use the preset security policies in Microsoft Defender (Standard or Strict). If you have Defender for Office 365 (Business Premium includes Plan 1), they also turn on Safe Links and Safe Attachments.

Apps and sharing

• Stop users from consenting to apps on their own and turn on the admin consent workflow. A fake “sign in with Microsoft” app can get access to mail and files without ever knowing the password.
• Review external sharing in SharePoint and OneDrive: links for specific people rather than “Anyone”, and an expiry date for guest links.
• Review guest accounts once in a while and remove the ones nobody needs any more.

Devices

• Require compliant devices if you have Intune: disk encryption, updates and a screen lock before a device can reach company data.
• Keep personal devices to the browser or to managed apps, so company files don’t end up stored on phones and laptops you don’t manage.

Visibility

• Check that audit logging is on (Microsoft Purview → Audit). Without it there is nothing to look at after an incident.
• Make sure a person receives the alerts from Microsoft Defender, not a mailbox nobody reads.
• Read Microsoft Secure Score as a to-do list, not a target: each action says what it changes for users. Apply them one by one and tell people before you do.

Don’t forget backup

Microsoft 365 keeps deleted items only for limited retention periods. That is not a backup: a deletion, a ransomware sync or a departing employee can outlast it. See the backup and recovery checklist.