Key takeaways
- Enforce MFA for everyone and block legacy sign-in
- Configure email filtering and domain authentication
- Manage devices and sharing settings
- Back up Microsoft 365 data separately
Microsoft 365 is secure by design, but many tenants still run with default settings that leave gaps. These steps close the most common ones.
Identity and sign-in
Start with who can sign in and how:
- Enforce multi-factor authentication for every user
- Block legacy authentication protocols
- Use separate admin accounts for administration
- Apply conditional access by location and device
Email protection
Enable Defender for Office 365 or equivalent filtering, configure SPF, DKIM and DMARC, and turn on alerts for suspicious forwarding rules, a common sign of a compromised mailbox.
Devices
Use Intune to require encrypted, up-to-date devices before they can access company data, and enable remote wipe for lost phones and laptops.
Data sharing
Review external sharing settings in SharePoint and OneDrive. Allow sharing with specific people rather than 'anyone with the link' for sensitive files.
Backups
Microsoft's retention isn't a full backup. Use a third-party backup for mailboxes, OneDrive, SharePoint and Teams so you can restore anything, whenever you need it.
Monitoring
Review Secure Score regularly and act on its recommendations. Audit logs should be enabled so incidents can be investigated.
Licensing for security
Some security features depend on your plan. Microsoft 365 Business Premium includes conditional access, Intune, Defender for Business and Defender for Office 365, which cover most of this checklist. For many small businesses, upgrading licences is the most cost-effective way to improve security.
Quick wins this week
If you do nothing else, start with:
- Turning on MFA for all accounts
- Reviewing who has global admin rights
- Checking for suspicious mailbox forwarding rules
- Enabling audit logging
- Setting up a third-party backup
- Removing licences and access for former staff
Protecting admin accounts
Administrator accounts are the keys to your entire Microsoft 365 tenant, which makes them the top target for attackers. Keep the number of global administrators to a minimum, ideally two or three trusted people. Use separate admin accounts that aren't used for everyday email or browsing, protect them with strong multi-factor authentication such as an authenticator app or security key, and consider privileged access features that grant admin rights only when needed. Keep an emergency 'break glass' account secured offline in case normal admin access is lost.
Training your team
Technology controls work best alongside informed users. Teach staff how to recognise phishing emails and fake Microsoft login pages, how to use MFA correctly and why they should never approve a sign-in request they didn't start. Show them how to share files securely with clients and how to report anything suspicious. Short, regular sessions and simulated phishing tests keep security top of mind without taking much time away from work.
Handling departing employees
When someone leaves, their Microsoft 365 account can become a security gap if it isn't handled properly. Block sign-in on their last day, reset the password and revoke active sessions on all devices. Convert the mailbox to a shared mailbox if colleagues need access to past emails, and set an automatic reply directing contacts to the right person. Transfer ownership of OneDrive files, Teams and SharePoint sites, then remove the licence to stop paying for it. Wipe company data from their phone and collect company devices. A simple checklist agreed between HR and IT makes sure every step happens every time, and nothing is left open for months after someone has gone.
Need help?
We run Microsoft 365 security reviews and fix the gaps, usually within a few days.
Frequently asked questions
A Microsoft tool that rates your tenant's security configuration and recommends improvements.
Microsoft keeps the service available, but protecting your data against deletion or compromise is your responsibility.
For most small businesses it offers the best balance of productivity and security features.
A typical small-business review and remediation takes a few days.
