Microsoft 365 Security Checklist for Small Businesses
Most Microsoft 365 tenants are left on default settings that attackers know well. This checklist covers the settings that stop the most common attacks: account takeover, phishing, data leakage and lost email.
Brandon Strangman8 min read
For most small businesses, Microsoft 365 is the business. Email, files, Teams, calendars and often the login to every other system all run through it. That makes a Microsoft 365 account the most valuable thing an attacker can steal from you, and the most common way they get in.
The good news is that Microsoft 365 includes strong security controls. The bad news is that many of them are not switched on by default, or were configured once years ago and never revisited. Work through this checklist, or ask your IT provider to confirm each item.
Identity and sign-in
1 Multi-factor authentication for every account
Every user, every shared mailbox that can sign in, and especially every administrator must use multi-factor authentication (MFA). Prefer the Microsoft Authenticator app with number matching, or a hardware security key, over SMS codes.
Stolen passwords are the most common way into a Microsoft 365 tenant. MFA stops the large majority of those attacks even when the password is known.
2 Security Defaults or Conditional Access
If your licences do not include Microsoft Entra ID P1, turn on Security Defaults. It enforces MFA and blocks legacy sign-in methods in one switch. If you have Microsoft 365 Business Premium, use Conditional Access policies instead, which give you finer control such as requiring MFA from outside the office, blocking sign-ins from countries you do not operate in, and requiring managed devices.
3 Block legacy authentication
Older protocols such as POP, IMAP and basic SMTP authentication cannot enforce MFA. Attackers use them to bypass it. Block them unless you have a specific, documented need, and if you do, restrict that exception to the one account that needs it.
4 Separate administrator accounts
Administrators should do their day-to-day work, including reading email, on a normal account, and use a separate admin account only for admin tasks. Keep the number of Global Administrators to the minimum you need, ideally two, and protect them with the strongest MFA you have.
5 Remove accounts for people who have left
Disable or delete accounts promptly when staff leave, convert their mailbox to a shared mailbox if you need to keep it, and remove their licence. Review the user list at least quarterly.
Email protection
6 Anti-phishing and safe attachments
Microsoft Defender for Office 365, included in Business Premium, adds Safe Links and Safe Attachments, which check links and attachments before users open them. Turn on impersonation protection for your directors and finance staff, the people attackers most often pretend to be.
7 Block automatic forwarding to external addresses
A compromised account that silently forwards every email to an outside address is a classic attacker tactic. Block external auto-forwarding by default, and allow it only for specific accounts that need it.
8 Alert on suspicious inbox rules
Set up alerts for new inbox rules that forward, delete or move messages. Attackers use these rules to hide replies from clients and suppliers while they run invoice fraud from your account.
9 SPF, DKIM and DMARC on your domain
These three DNS records tell other mail servers which systems are allowed to send email as your domain. Without them, anyone can send email that appears to come from your business. Start DMARC in monitoring mode, review the reports, then move to a policy that rejects forged mail.
Data and sharing
10 Control external sharing
Review the SharePoint and OneDrive sharing settings. "Anyone with the link" sharing is convenient but means a forwarded link gives access to anyone. For most businesses, sharing with specific people, with link expiry, is a better default.
11 Protect devices that access company data
If staff use their own phones for email, use Intune app protection policies so company data stays in managed apps and can be removed if the phone is lost or the person leaves. Company laptops should be enrolled in device management with disk encryption enabled.
12 Back up Microsoft 365
Microsoft keeps your service running, but protecting your data from deletion, ransomware and mistakes is largely your responsibility. Recycle bins and retention settings have limits. A third-party Microsoft 365 backup gives you independent, point-in-time copies of mailboxes, OneDrive, SharePoint and Teams.
If you do only three things this week, turn on MFA for everyone, block legacy authentication, and block external auto-forwarding. Together they shut down the most common Microsoft 365 attacks we see.
Monitoring and review
13 Turn on audit logging
Make sure unified audit logging is enabled so you have a record of sign-ins, mailbox access and file activity. Without it, investigating an incident is mostly guesswork.
14 Review Secure Score
Microsoft Secure Score, in the Defender portal, rates your tenant's configuration and suggests improvements. It is a useful checklist, although not every recommendation fits every business.
15 Review regularly
Settings drift. New staff join, apps get connected, exceptions get made and never removed. A quarterly review keeps your tenant where you left it.
Which licence do you need?
Microsoft 365 Business Basic and Business Standard include MFA and Security Defaults, which cover the essentials. Business Premium adds Conditional Access, Intune device management, Defender for Business and Defender for Office 365, which is why it is our usual recommendation for businesses that handle client or financial data. The right choice depends on your risk and your budget, and mixing licence types across staff is often sensible.
Want someone to check your tenant?
Our Microsoft 365 security and management service hardens and monitors tenants for Brisbane businesses, and you can tell us what you need or call us on (07) 3521 8515 to talk through which of these fifteen items need attention in your business.
Quick Reference Summary
Written byBrandon StrangmanNeed Help with Your Business IT?
Ready to implement these strategies? Our expert team at Defy IT can help you build a resilient, secure IT environment tailored to your specific business needs.
Contact Us TodayReading up on cybersecurity? Explore our Microsoft 365 services or see how we help law firms and professional services firms.