MICROSOFT 365 SECURITY GUIDE
Microsoft 365 security checklist for small businesses
A practical review of identity, email, sharing, devices and recovery controls for a safer cloud environment.
Microsoft 365 often sits at the centre of a small business. Email, calendars, Teams, OneDrive, SharePoint and administrator controls may all depend on the same identities. If one important account is compromised, an attacker may be able to impersonate employees, redirect payments, access files or create persistent access.
The platform includes useful protections, but security still depends on configuration, licensing, administration and everyday user behaviour. This checklist gives small and growing businesses a clear starting point for reviewing the controls they manage.
Protect identity and email first
Begin with administrator accounts and business email. These accounts can reset passwords, change settings and communicate as trusted employees. Microsoft’s security defaults provide a baseline that includes MFA registration, stronger protection for administrators and blocking legacy authentication. Organizations with eligible licensing and more complex requirements can use Conditional Access for greater control.
Before changing tenant-wide settings, confirm your licensing, document existing applications and understand whether printers, scanners or older software still depend on legacy email methods. Security changes should be planned so they do not unexpectedly interrupt business operations.
The 12-point Microsoft 365 security checklist
Enable MFA for every user
Require multi-factor authentication across the organization, starting with administrators, finance, executives and anyone handling sensitive information. Prefer the Microsoft Authenticator app, passkeys or other phishing-resistant methods where available instead of relying only on SMS.
Separate administrator and everyday accounts
Administrators should use a standard account for email and routine work and a separate privileged account only for administration. This reduces the exposure of powerful credentials to daily email and browsing risks.
Reduce privileged roles
Assign only the permissions required for each responsibility. Review Global Administrator and other privileged roles regularly, remove unnecessary access and avoid using shared administrator accounts.
Prepare emergency access
Document how the business will recover if normal administrators are locked out. Microsoft recommends carefully controlled cloud-only emergency access accounts for organizations using Conditional Access. Protect, monitor and test them according to an approved procedure.
Block legacy authentication
Older authentication protocols do not support modern security controls and can allow MFA bypass. Identify dependencies first, modernize or replace them, and then block legacy access through security defaults or appropriate Conditional Access policies.
Apply recommended email threat policies
Review anti-phishing, anti-spam, anti-malware, Safe Links and Safe Attachments capabilities available in your license. Microsoft provides Standard and Strict preset security policy recommendations; test changes and tune them to business needs.
Configure SPF, DKIM and DMARC
Authenticate every domain and legitimate sending service. SPF identifies approved senders, DKIM signs messages and DMARC tells receiving systems how to handle messages that fail alignment. Begin DMARC with monitoring, correct legitimate sources, then strengthen enforcement deliberately.
Control external sharing
Review SharePoint, OneDrive and Teams sharing settings. Use the least-permissive option that supports the business, prefer authenticated guests, set expiration where appropriate and remove links or guest access that are no longer required.
Manage devices and sessions
Require supported and updated devices, screen locks, encryption and endpoint protection. Where licensing permits, use Intune and Conditional Access to set device and sign-in requirements. Revoke sessions promptly after suspected compromise or employee departure.
Secure onboarding and offboarding
Use a documented process for creating accounts, assigning licenses and access, transferring business information and disabling access. Confirm mailbox, OneDrive, Teams, groups, shared mailboxes and mobile devices during departure.
Plan retention, recovery and independent backup
Understand what Microsoft retention and recycle-bin features cover, how long information remains recoverable and what your business must restore after deletion, ransomware or configuration errors. Evaluate an independent Microsoft 365 backup when recovery requirements exceed built-in capabilities.
Monitor alerts, sign-ins and Secure Score
Review risky or unusual sign-ins, forwarding rules, administrator changes, security alerts and audit information available in your plan. Use Microsoft Secure Score as a prioritization tool, not as proof that the environment is fully secure.
A useful rule: verify unusual requests outside email
If a message requests a payment change, confidential file, password reset or urgent purchase, confirm the request through a known telephone number, approved business chat or another trusted channel. A familiar display name does not prove that the message is genuine.
A practical first-week plan
Warning signs that require attention
Investigate unexpected MFA prompts, unfamiliar sign-in locations, new inbox forwarding rules, messages in Sent Items that the user did not send, unexplained administrator or guest accounts, sudden permission changes, missing emails, unusual file downloads and payment requests that bypass normal procedures.
If compromise is suspected, use a known-clean device to protect affected accounts, revoke active sessions, review authentication methods and forwarding rules, preserve evidence and check other connected systems. Contact financial institutions quickly if payment information may have been changed or exposed.
Official Microsoft guidance and next steps
Microsoft documents security defaults as a baseline against common identity attacks and recommends Standard or Strict preset email threat policies for cloud organizations. Microsoft also provides guidance for email authentication and Secure Score to help administrators identify improvement actions.
Review Microsoft’s official guidance on Microsoft Entra security defaults, recommended email and collaboration threat policies, email authentication and Microsoft Secure Score.
For broader business protection, also review CommzzTech’s cybersecurity checklist for small businesses in Toronto.
Important: This article provides general information. Microsoft features, interfaces and licensing change over time. Confirm current documentation and assess operational, privacy, legal and compliance requirements before making tenant-wide changes.
NEED A MICROSOFT 365 REVIEW?
Turn this checklist into a prioritized action plan.
CommzzTech can help review configuration, identify practical gaps and plan improvements appropriate for your business and licensing.