Microsoft 365 security for small businesses: a 12-step checklist
Most small companies run their email, files and calendars in Microsoft 365, yet many tenants still use the settings they had on day one. Attackers know this. The most common incident we see is not a clever exploit but a stolen password that opens a mailbox, followed by fake invoices sent to customers from a real address.
Below is the checklist we work through when we take over a Microsoft 365 tenant for a company of 5 to 100 people. Most steps take minutes and none of them require extra licenses unless noted.
1. Turn on multi-factor authentication for everyone
If you do only one thing, do this. MFA blocks the vast majority of password-based attacks. On Business Basic and Standard plans, enable Security defaults in Entra ID. On Business Premium, use Conditional Access policies instead, which give you more control. Prefer the Microsoft Authenticator app with number matching over SMS codes.
2. Block legacy authentication
Old protocols such as POP, IMAP and basic SMTP authentication do not support MFA, so attackers use them to bypass it. Security defaults block them automatically. With Conditional Access, create a policy that blocks “other clients”. Check first whether an old scanner or line-of-business app still sends mail this way and move it to a modern method.
3. Separate admin accounts from daily accounts
Nobody should read email with a Global Administrator account. Create dedicated admin accounts (for example admin.anna@company.com), protect them with phishing-resistant MFA and keep only two or three Global Administrators. Give other people narrower roles such as User Administrator or Exchange Administrator.
4. Set up an emergency access account
Keep one cloud-only “break glass” Global Administrator with a long random password stored offline, excluded from Conditional Access. If MFA or a policy locks everyone out, this account gets you back in. Monitor its sign-ins and alert on any use.
5. Protect your domain with SPF, DKIM and DMARC
These three DNS records tell receiving servers which mail really comes from you. Without them, anyone can send email that looks like it comes from your domain. Enable DKIM signing in the Microsoft Defender portal, publish SPF and start DMARC in monitoring mode. We explain the details in our article on SPF, DKIM and DMARC.
6. Disable automatic forwarding to external addresses
After taking over a mailbox, attackers often create a rule that silently forwards all mail outside. In the outbound spam policy, set automatic forwarding to “Off”. If a few users really need forwarding, allow it only for them.
7. Turn on Defender for Office 365 features you already have
Business Premium includes Safe Links and Safe Attachments. Apply the Standard preset security policy to all users. It is maintained by Microsoft and is better than custom settings that nobody reviews. On lower plans, make sure the built-in anti-phishing policy has impersonation protection for your managers and finance team.
8. Review external sharing in SharePoint and OneDrive
“Anyone with the link” sharing is convenient and dangerous. Change the default link type to “Specific people”, set expiry for guest links and decide whether employees may share with any external address or only with approved domains.
9. Restrict app consent
A popular attack asks users to grant a malicious app access to their mailbox. In Entra ID, allow users to consent only to apps from verified publishers with low-risk permissions, and send everything else to an admin for approval.
10. Turn on audit logging and alerts
Unified audit logging should be on by default, but check it. Then configure alerts for new inbox forwarding rules, mass file downloads and sign-ins from unusual countries. You cannot investigate what you did not record.
11. Manage devices, not just accounts
With Business Premium you can use Intune to require encryption, a screen lock and up-to-date systems on laptops and phones that access company data. Even a basic policy, such as blocking downloads to unmanaged devices, closes a large gap.
12. Back up what Microsoft does not
Microsoft keeps the service running, but it does not protect you from a user deleting a folder six months ago or ransomware encrypting OneDrive. Retention policies help, and a third-party Microsoft 365 backup gives you point-in-time restores of mail, OneDrive and SharePoint.
How long does this take?
For a company of 20 people, steps 1 to 10 usually take one working day, including testing and telling users what changes. Devices and backup take a few more days. The biggest risk is not technical: it is rolling out MFA without warning people. Send a short message the day before, explain how to install the Authenticator app and keep someone available for questions.
Want to know where your tenant stands? Our free IT audit checks your email security from the outside, and at onboarding we review accounts, admin roles and MFA coverage.