Microsoft 365 Security Checklist

Microsoft 365 is where most small businesses keep email, files and conversations, which makes it the first place attackers look. These steps close the most common gaps. Work through them in order.

Turn on MFA for everyone

Multi-factor authentication stops most password-based account takeovers.

• Require MFA for every user, including executives and shared admin accounts.
• Prefer an authenticator app or security key over text messages.
• Block legacy authentication, which bypasses MFA entirely.
• Use separate admin accounts for administration, never a daily mailbox.

Review sign-in and sharing settings

• Limit external sharing in SharePoint and OneDrive, and make sharing links expire.
• Turn off automatic forwarding of mail to outside addresses.
• Tag external email so staff can see when a message came from outside.
• Turn on anti-phishing and impersonation protection for executives and finance staff.
• Review which third-party apps can access your data, and remove the ones you do not use.

Watch for takeover signs

Settings reduce risk; monitoring catches what slips through. Set alerts for:

• Sign-ins from unusual locations or impossible travel.
• New inbox rules that move, delete or forward mail.
• Changes to MFA methods or admin roles.
• Sudden spikes in sent email.

Someone needs to act on these alerts. As part of managed IT, our engineers review them during office hours and lock accounts when something looks wrong. Our guide to business email compromise warning signs explains what a takeover looks like.

Right-size licenses

• Match each person to the plan their role needs.
• Remove licenses from former staff and convert their mailboxes properly.
• Check whether a higher plan would replace separate tools you already pay for.

Back up Microsoft 365

Microsoft keeps the service running, but deleted or encrypted data can still be lost. Add a separate backup for mailboxes, OneDrive, SharePoint and Teams. See backup and disaster recovery.

Security defaults or conditional access

Every Microsoft 365 tenant can turn on security defaults, a free baseline that requires MFA registration, blocks legacy sign-in and adds extra checks for administrators. It is a good starting point for small offices with simple needs.

Conditional access, included with Microsoft Entra ID P1 and plans such as Microsoft 365 Business Premium, gives finer control. Common policies include:

• Require MFA for all users, with stronger methods for admins.
• Block sign-ins from countries where you have no staff.
• Allow access to company data only from managed, compliant devices.
• Require MFA again for risky sign-ins or sensitive actions.

Use one approach or the other. Conditional access replaces security defaults once your policies are in place.

Protect administrator accounts

Admin accounts can change every setting in the tenant, so they deserve the most care.

• Keep the number of Global Administrators small. Microsoft recommends fewer than five.
• Give people the narrowest role that does the job, such as Exchange or User Administrator.
• Use phishing-resistant MFA, such as passkeys or security keys, for every admin.
• Keep one or two emergency access accounts, stored securely and monitored, in case normal sign-in fails.
• Review admin role assignments every quarter and remove anyone who no longer needs them.

Check your Secure Score

Microsoft Secure Score, in the Microsoft Defender portal, rates your tenant’s settings and lists recommended actions with their impact. It is not a compliance certificate, but it is a useful to-do list and a simple way to show progress to leadership or an insurer. Review it monthly and record why you accept any recommendation you choose not to follow.

Turn on and keep audit logs

The unified audit log records sign-ins, mailbox access, file sharing and admin changes. It is on by default for most tenants, but confirm it. Standard plans keep audit records for 180 days; higher plans keep them longer. If an incident is discovered months later, those logs are how you learn what was touched. Some organizations export logs to separate storage so they survive longer.

Manage the devices that connect

Settings in the cloud do not help if a lost laptop has no password or encryption. With Microsoft Intune, included in Business Premium, you can:

• Require disk encryption and a screen lock on every company device.
• Keep Windows and Office updated on a schedule.
• Remove company data from a lost or stolen phone without erasing personal photos.
• Block access from devices that fall out of compliance.

Offboard people properly

Former staff are a common gap. When someone leaves, block sign-in, reset their password, revoke active sessions, remove them from groups and shared mailboxes, transfer their OneDrive files to a manager and convert their mailbox if you need to keep it. Do the same review for contractors and vendors with guest access.

Review Teams and guest access

Teams makes it easy to invite outside people, which is useful and risky. Decide who can add guests, review guest accounts regularly, set expiration for guest access where possible and limit external chat to the domains you work with.

Set up email authentication

Three DNS records tell other mail systems which servers may send mail for your domain and what to do with messages that fail the check:

• SPF lists the services allowed to send as your domain.
• DKIM adds a digital signature to outgoing mail.
• DMARC tells receivers to report on, quarantine or reject mail that fails, and sends you reports.

Start DMARC in monitoring mode, review the reports to find every service that sends on your behalf, such as billing or marketing tools, then move to quarantine and reject. Since 2024, large mailbox providers such as Gmail, Yahoo and Outlook.com require authentication from bulk senders, so these records also help your legitimate mail get delivered.

Label and protect sensitive files

Plans with Microsoft Purview features let you label documents as confidential and apply protection that travels with the file, such as encryption or blocking forwarding. Data loss prevention policies can warn staff before they email a spreadsheet full of Social Security numbers or card numbers outside the company. Start with a few clear labels and one or two policies for your most sensitive data, then expand once staff are comfortable.

Check it again every quarter

Microsoft adds features and changes defaults often, and your company changes too: new staff, new apps, new vendors with guest access. A setting that was right last year may not be right today. Put a short quarterly review on the calendar: look at Secure Score, admin roles, guest accounts, third-party app permissions, forwarding rules and licenses, and note what changed. Most reviews take one sitting and catch problems while they are still small.

Quick checklist

1. MFA on for every account, legacy authentication blocked.
2. Separate admin accounts.
3. External sharing and forwarding limited.
4. Phishing and impersonation protection on.
5. Alerts set and someone assigned to act on them.
6. Licenses reviewed.
7. Separate backups in place.