For many small businesses, Microsoft 365 is no longer just Word and Excel. It is the company directory, email system, document cabinet, meeting room, shared workspace, password-reset path, and sometimes the place where invoices and contracts live. That concentration is convenient. It also means one compromised account can expose far more than a single inbox.
The good news is that Microsoft 365 includes a substantial security foundation. The less comfortable news is that subscriptions, old settings, exceptions, guest access, connected applications, and day-to-day administration can produce gaps over time. A tenant that was configured correctly two years ago may not reflect today's employees, devices, vendors, or risks.
Before you change anything
Security changes can lock out users, interrupt older applications, or block legitimate mail when they are applied without testing. Record the current configuration, identify the business owner for the change, test with a small group where possible, define a rollback path, and schedule high-impact changes when support is available.
Features also vary by subscription. Microsoft 365 Business Basic and Standard include important identity and email protections, while Business Premium commonly adds capabilities such as Conditional Access, Intune, Defender for Business, and Defender for Office 365 Plan 1. Microsoft changes product packaging, so confirm current licensing in your own tenant before designing a control around a feature.
The 12-point Microsoft 365 security checklist
1. Inventory users, licenses, administrators, domains, and connected apps
Begin with what actually exists. Export active and blocked users, assigned licenses, privileged roles, guest accounts, accepted domains, enterprise applications, mail connectors, forwarding rules, shared mailboxes, and registered devices. Find accounts that belong to former workers, duplicate administrators, unused trial licenses, forgotten vendors, and applications that were approved for a one-time project.
- Every account should have a current owner and business purpose.
- Every administrator role should have a named reason and review date.
- Every guest and connected application should have an internal sponsor.
- Every sending service should be documented before changing email-authentication records.
This inventory becomes the map for the remaining steps. Without it, administrators tend to secure the visible accounts while old integrations and exceptions remain untouched.
2. Require MFA for every user—especially administrators
Microsoft's Security Defaults are designed to provide a baseline against common identity attacks and are suitable for many organizations with straightforward needs. New Microsoft 365 business tenants normally have Security Defaults enabled, but “normally” is not the same as verified. Check the actual status and confirm that every user has registered an approved authentication method.
Businesses with Microsoft Entra ID P1 or an eligible suite can use Conditional Access for more specific policies, such as requiring a compliant device, controlling access by risk or location, or using stronger authentication for sensitive roles. Do not enable Security Defaults and Conditional Access as competing strategies; choose and document the approach that fits the tenant.
- Prioritize phishing-resistant methods such as passkeys or FIDO2 security keys for administrators and high-risk users.
- Do not rely on SMS as the long-term strongest option when better methods are practical.
- Remove authentication methods tied to former employees or replaced devices.
- Test account-recovery procedures so MFA does not depend on one person's phone.
3. Separate daily work from administration
An administrator should not read everyday email and browse the web using the same highly privileged account used to change tenant-wide settings. Give administrators a standard account for normal work and a separate account for administrative tasks. Assign the least powerful role that completes the job instead of defaulting to Global Administrator.
Microsoft's current role guidance recommends keeping the number of Global Administrators below five. It also recommends two cloud-only emergency access accounts for scenarios where normal administration is unavailable. These emergency accounts need strong, independent authentication, protected credentials, monitoring, documentation, and regular testing—not casual everyday use.
4. Remove legacy authentication and risky exceptions
Older mail clients, scanners, multifunction printers, scripts, and line-of-business applications may use authentication methods that do not support modern protections. Security Defaults blocks legacy authentication, and Conditional Access can be used to control it in more advanced environments. Before enforcing a block, use sign-in data and an application inventory to find legitimate dependencies and replace them safely.
Be especially cautious with permanent trusted-location exclusions, broad “exclude from MFA” groups, shared passwords, app passwords, and service accounts that never expire. An exception created during an outage can quietly become the easiest path into the tenant.
5. Use Microsoft Secure Score as a prioritized worklist
Microsoft Secure Score measures which recommended actions are implemented and helps expose gaps across identities, devices, applications, and data. Use it to organize work and record why a recommendation is accepted, planned, mitigated another way, or not applicable.
A higher score does not prove that a business is secure, and chasing 100 percent can create disruption without proportional benefit. Start with improvements that reduce common, high-impact risks: MFA, protected administrators, risky sign-in controls, email policies, endpoint protection, and removal of stale access.
6. Apply the right email-protection policies
Exchange Online Protection provides anti-spam, anti-malware, and basic anti-phishing capabilities for Microsoft 365 cloud mailboxes. Microsoft Defender for Office 365 adds features such as Safe Links, Safe Attachments, and advanced impersonation protection depending on the plan.
Review Microsoft's preset security policies before building a collection of custom rules. Built-in protection provides a baseline, while Standard and Strict preset policies can apply stronger recommended settings to selected users. Protect executives, finance, payroll, human resources, and anyone who can approve payments or access sensitive records.
- Review mailbox forwarding, inbox rules, transport rules, connectors, and allowed-sender lists.
- Avoid broad allowlists: Microsoft warns that allowed senders and domains bypass much of the normal filtering and authentication checking.
- Configure user and domain impersonation protection where licensing supports it.
- Give employees a clear way to report suspicious messages and define who investigates them.
7. Configure SPF, DKIM, and DMARC together
Email authentication helps receiving systems determine whether a message claiming to come from your domain is legitimate. Microsoft explicitly recommends using SPF, DKIM, and DMARC together. SPF lists authorized sending systems, DKIM adds a cryptographic signature, and DMARC checks alignment with the visible From domain and tells receivers how to handle failures.
- Document every legitimate sender, including marketing, invoicing, CRM, ticketing, and website platforms.
- Create one valid SPF record that includes the necessary services without exceeding technical lookup limits.
- Enable DKIM signing for each active custom sending domain and subdomain.
- Start DMARC with reporting, study legitimate failures, correct them, and then move deliberately toward quarantine or reject.
- Monitor aggregate reports and repeat the review whenever a sending platform changes.
8. Control SharePoint, OneDrive, and Teams sharing
External collaboration is a useful Microsoft 365 feature, but sharing settings exist at organization and site levels. A permissive tenant setting can allow individual sites to share broadly unless they are restricted. Decide which sites may contain guests, whether “Anyone” links are appropriate, how long links should remain valid, and whether guests must authenticate.
- Prefer “Specific people” links for confidential or customer information.
- Use more restrictive settings for finance, HR, legal, executive, and operational sites.
- Review guest users, site owners, anonymous links, and externally shared files regularly.
- Remove access when a project or vendor relationship ends.
- Teach users that Teams files are usually stored in SharePoint and follow SharePoint permissions.
Microsoft provides site-level sharing reports that can export links, users, permissions, and shared items. Use those reports during access reviews instead of depending on memory.
9. Decide which devices may access company data
MFA protects the sign-in, but it does not make an outdated, unencrypted, malware-infected, or shared computer trustworthy. Microsoft Intune can manage device configuration and compliance, while Conditional Access can use the compliance state when deciding whether to permit access.
Define minimum operating-system versions, encryption requirements, screen-lock rules, endpoint protection, and whether rooted or jailbroken devices are blocked. For personal phones, app-protection policies can help keep company information inside managed applications even when full device enrolment is not appropriate.
One easy-to-miss Intune setting determines how devices with no assigned compliance policy are treated. Microsoft's current documentation notes that the default treats them as compliant. Organizations using compliance with Conditional Access should evaluate changing this behaviour so an unassessed device is not automatically trusted.
10. Classify sensitive information and limit accidental movement
Identify where customer records, employee information, contracts, financial documents, credentials, and regulated information live. Depending on licensing and business needs, sensitivity labels, encryption, Data Loss Prevention, app-protection policies, and restricted sharing can reduce accidental exposure.
Start with a small classification scheme employees can understand. “Public, Internal, Confidential, Restricted” is more useful than fifteen labels nobody applies correctly. Test policies in audit or simulation modes where available before blocking normal work.
11. Monitor the signals that indicate account compromise
A secure configuration still needs detection. Review sign-ins, administrator changes, new authentication methods, unusual mailbox rules, external forwarding, mass downloads, guest invitations, application consent, and emergency-account activity. Licensing affects log detail and retention, so confirm what is available and whether important logs need to be exported elsewhere.
- Alert when an emergency access account signs in.
- Investigate unexpected MFA registrations or repeated failed challenges.
- Review automatic forwarding to external domains.
- Watch for new Global Administrators and high-impact application permissions.
- Establish who receives alerts outside business hours and what they should do.
12. Test recovery, offboarding, and incident response
Cloud availability, version history, retention, recycle bins, and backup are related but not identical. Define what the business must recover, from which failure scenarios, how far back recovery must reach, how quickly it is needed, and who can perform it. Then test the procedure. If native Microsoft 365 capabilities do not meet those requirements, evaluate an independent backup approach.
Offboarding should disable sign-in, revoke sessions, remove licences and group memberships as appropriate, transfer files and mail ownership, remove authentication methods and registered devices, and review shared credentials or applications the person managed. Do not leave former-worker accounts active simply because their mailbox contains useful history.
Maintain a short incident playbook for a compromised account: disable or block the account, revoke sessions and tokens, reset authentication, inspect sign-in and audit history, remove malicious inbox rules or forwarding, check administrative and application changes, assess exposed data, notify required parties, and record lessons learned.
What can you do with each business plan?
| Control area | Basic or Standard starting point | Business Premium expansion |
|---|---|---|
| Identity | Security Defaults and MFA registration | Conditional Access and more granular identity controls |
| Exchange Online Protection, anti-spam, anti-malware, basic anti-phishing, SPF/DKIM/DMARC | Defender for Office 365 Plan 1 features such as Safe Links, Safe Attachments, and additional anti-phishing capabilities | |
| Devices | Document requirements and secure devices manually or with another platform | Intune device management, compliance, and app protection |
| Endpoints | Built-in operating-system protections and another managed security approach | Microsoft Defender for Business capabilities |
| Data | Sharing controls, permissions, retention options available to the plan | Additional information-protection and management capabilities depending on exact licensing |
This table is a planning summary, not a licensing contract. Microsoft can change included features, prerequisites, and limits. Verify the service description and your tenant before promising a control to the business.
A useful 30-minute management review
A complete technical assessment takes longer, but a business owner can ask these questions today and quickly discover whether deeper work is needed.
- Can we prove every active user and administrator has appropriate MFA?
- How many Global Administrators do we have, and why does each one need that role?
- Do we have tested emergency access that does not depend on one employee's device?
- Are SPF, DKIM, and DMARC configured for every sending domain?
- Which mailboxes forward externally, and who approved them?
- Which SharePoint sites and files are available to guests or anonymous links?
- Can unmanaged or unencrypted devices download confidential documents?
- Who reviews security alerts and what happens after hours?
- When did we last test recovery of email, OneDrive, SharePoint, and Teams data?
- Can we remove a departing employee's access and preserve required business data the same day?
Common warning signs
- Several people share one administrator account.
- Nobody knows whether Security Defaults or Conditional Access is active.
- All users are excluded from a policy through a broad exception group.
- The domain has SPF but no verified DKIM or DMARC rollout.
- Former workers remain licensed and can still sign in.
- Anyone links are common and external access is never reviewed.
- Employees use personal, unmanaged computers to download customer records.
- Security alerts go to an inbox nobody checks outside business hours.
- The recovery plan is “Microsoft has a backup,” but no recovery test or business requirement exists.
The bottom line
Microsoft 365 security is not one switch and it is not a one-time project. It is a set of decisions about identity, administration, email, sharing, devices, data, monitoring, and recovery. Most serious gaps are not exotic—they are old accounts, broad roles, missing MFA, undocumented senders, forgotten guests, unmanaged devices, or alerts without an owner.
Start with the first five controls, document what you find, and fix the highest-impact gaps before buying another product. A well-managed basic environment is safer than an expensive security suite nobody configured, reviewed, or tested.