Microsoft 365 Security Checklist for Small Businesses

Short answer: To secure Microsoft 365 for a small business, turn on multifactor authentication (MFA) for every account, block legacy sign-ins, keep fewer than five Global Administrators, set up SPF, DKIM and DMARC for your email domain, block automatic forwarding to outside addresses, review how files are shared, and back up your mailboxes, OneDrive and SharePoint. Then check your Microsoft Secure Score every month and fix the top items.

Most of these settings are already in the Microsoft 365 plan you pay for. They just aren’t always switched on, or they were set up years ago and never reviewed. The checklist below walks through each one in plain language, in the order we’d tackle them.

Why Microsoft 365 is the account attackers want

For most small offices, Microsoft 365 holds everything: email, contracts, client files, payroll messages and Teams chats. One stolen password can open all of it.

That’s why business email compromise (BEC) is so costly. In its 2025 Internet Crime Report, the FBI’s Internet Crime Complaint Center recorded 24,768 BEC complaints with about $3.05 billion in reported losses, second only to investment fraud. Phishing and spoofing was the most-reported crime type, with 191,561 complaints.

Microsoft’s own guidance points to the same fix. On its security defaults page, Microsoft says that, based on its learnings, more than 99.9% of common identity-related attacks are stopped by using MFA and blocking legacy authentication.

The Microsoft 365 security checklist

Work through these in order. The first three close the biggest gaps.

1. Turn on MFA for every account

• If you don’t have Microsoft Entra ID P1 (most Business Basic and Standard plans), turn on security defaults in the Microsoft Entra admin center (Entra ID > Overview > Properties > Manage security defaults). It requires every user to register for MFA, requires MFA for admins, and blocks legacy authentication.
• If you have Microsoft 365 Business Premium, it includes Entra ID P1, so you can use Conditional Access policies instead. Microsoft lists this in its Microsoft 365 for business security overview.
• Use the Microsoft Authenticator app rather than text messages where you can.
• Don’t forget shared mailboxes that someone signs in to directly, accounts for former staff, and the owner’s account.

2. Block legacy authentication

Older mail protocols such as IMAP, POP3 and basic SMTP don’t support MFA. Microsoft notes that an attacker can use an older protocol to get around an MFA policy. Security defaults block these sign-ins. With Conditional Access, create a policy that does the same.

Before you switch this on, check your scanners, copiers and any old apps that send email. They often still use basic SMTP and will need to be reconfigured first.

3. Lock down admin accounts

• Microsoft’s best practices for Entra roles recommend fewer than five Global Administrators.
• Give admins a separate admin account and use their normal account for daily email and browsing.
• Give people the smallest role that does the job. A person who resets passwords doesn’t need to be a Global Administrator.
• Microsoft recommends two cloud-only “break glass” emergency access accounts, so you can’t be locked out of your own tenant.
• Remove admin rights from anyone who has left or changed roles.

4. Protect your email domain with SPF, DKIM and DMARC

These three DNS records help receiving mail servers tell real email from your domain apart from forgeries. Microsoft’s email authentication guide explains that spoofed senders are commonly used in BEC and phishing, and that the three records work together.

• SPF: lists the services allowed to send mail for your domain (Microsoft 365, plus things like your newsletter or billing tool).
• DKIM: signs your outgoing mail so it can’t be quietly altered.
• DMARC: tells other mail systems what to do with mail that fails the checks. Start by monitoring the reports, then tighten the policy to quarantine or reject once all your real senders pass.

5. Stop automatic forwarding to outside addresses

A common move after an account is taken over is a hidden inbox rule that forwards mail to an outside address. Microsoft’s external forwarding guidance recommends setting the outbound spam policy to On or Off explicitly, rather than leaving it on “Automatic”, because the default can behave differently in older tenants. For most offices, Off is right, with exceptions only where there’s a real business need.

While you’re there, look for inbox rules that move or delete messages from your bank, your accountant or the CEO.

6. Review sharing in SharePoint, OneDrive and Teams

• Check whether “Anyone” links (no sign-in needed) are allowed. If they are, set them to expire, or limit sharing to people in your organization and specific guests.
• Review guest accounts every quarter and remove the ones that are no longer needed.
• Make sure departing staff have their access removed and their OneDrive handed over to a manager on their last day.

7. Protect the devices people use

Microsoft 365 is only as safe as the laptops and phones that sign in to it.

• Keep Windows, macOS, browsers and Office apps updated automatically.
• Use endpoint protection on every device. Business Premium includes Microsoft Defender for Business and Microsoft Intune Plan 1, which can enforce encryption, screen locks and updates.
• Decide what’s allowed on personal phones. Intune can protect company data in apps without managing the whole device.

8. Back up your Microsoft 365 data

The recycle bin and version history help with small mistakes, but they’re not a full backup. Ransomware, a malicious insider or an accidental mass delete can affect many files at once. Microsoft sells its own Microsoft 365 Backup service for exactly these cases, and there are third-party tools that do the same.

• Back up Exchange mailboxes, OneDrive and SharePoint.
• Test a restore at least once a year, so you know how long it really takes.

9. Train your team, and give them a plan

Settings stop most attacks, but people still get fooled. Short, regular phishing awareness training helps, and so does a simple rule: if anyone clicks a bad link or enters a password on a strange page, they report it right away, with no blame. Our guide on what to do if you click a phishing link is a good one to share with staff.

10. Check your Secure Score every month

Microsoft Secure Score, in the Microsoft Defender portal, measures how many recommended security settings you’ve turned on and lists what to do next. Turning on security defaults alone earns full points for three recommendations: MFA for all users, MFA for admins and blocking legacy authentication.

Microsoft is clear that the score isn’t a guarantee against a breach, and not every recommendation fits every office. Use it as a to-do list, not a grade.

For a deeper review, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) publishes free Secure Cloud Business Applications (SCuBA) configuration baselines for Microsoft 365, plus a no-cost assessment tool called ScubaGear. They were written for federal agencies, but CISA says any organization can use them.

A quick printable version

When to bring in help

You can do much of this yourself if you have an admin login and an afternoon. It gets harder when you have old devices that break when legacy sign-ins are blocked, several email services sending on your behalf, years of shared links, or compliance rules from clients, funders or regulators.

That’s where a managed IT partner helps. At Xala Tech Services, our Microsoft 365 and SharePoint team sets up and maintains these settings, and our managed cybersecurity services add monitoring and response on top. If you need help with backups, see our backup and recovery services. If you have to meet a framework such as HIPAA, our governance and compliance work covers the policy side. We’re based at 9504 Lee Hwy, Unit B, in Fairfax, and we work with small businesses, nonprofits, associations, law firms and medical offices across the DC area.

Get a free Microsoft 365 security scan

Not sure where your tenant stands? New clients get a free Microsoft 365 security scan, normally $1,500, with a written report on security weaknesses and setup.

Claim your free scan or call (703) 340-1110.

Frequently asked questions

Is Microsoft 365 secure out of the box?

Microsoft 365 includes strong security tools, but not all of them are switched on or set up the right way by default. New tenants usually have security defaults on, which require MFA. Older tenants, accounts created over the years, email authentication records, forwarding rules and sharing settings still need to be checked and set up by an admin.

Do I need Microsoft 365 Business Premium for good security?

No. Every Microsoft 365 for business plan includes security defaults, which turn on MFA and block legacy sign-ins at no extra cost. Business Premium adds Conditional Access, Microsoft Defender for Business, Defender for Office 365 Plan 1 and Intune Plan 1, which give you more control over devices, email threats and who can sign in from where.

How many Global Administrators should a small business have?

Microsoft recommends fewer than five Global Administrators, each protected with MFA. It also recommends two cloud-only emergency access accounts so you can’t be locked out. Everyone else should get the smallest admin role that does the job, or no admin role at all.

How often should we review Microsoft 365 security settings?

Check your Microsoft Secure Score and new recommendations once a month, and review admin roles, guest accounts and sharing links every quarter. Also review settings whenever someone joins or leaves, and after any suspicious sign-in or phishing click.