Microsoft 365 Security Checklist: What Should a Small Business Turn On?

Microsoft 365 includes security features and baseline protections, but their default configuration, availability, and retention depend on the tenant, workload, and license. Business Basic, Business Standard and Business Premium provide different capabilities. This checklist identifies important settings to verify and notes key licensing differences.

Download the Microsoft 365 Security Checklist (PDF) to print and work through with your IT provider.

The checklist at a glance

#	Area	Key action	License note
1	Sign-in	MFA for every account	All plans (security defaults); Conditional Access needs Entra ID P1, included in Business Premium
2	Admins	Separate admin accounts, minimal Global Admins, at least two emergency access accounts	All plans
3	Legacy sign-in	Block legacy authentication	All plans
4	Email	Anti-phishing, SPF, DKIM, DMARC, block auto-forwarding	Safe Links and Safe Attachments need Defender for Office 365, included in Business Premium
5	Sharing	Limit “Anyone” links, expire guest links	All plans
6	Devices	Require managed, encrypted devices	Intune included in Business Premium
7	Logging	Enable audit logging, review available alert policies, and check Secure Score	Audit logging must be verified and enabled manually for Business Basic, Standard and Premium; feature availability and retention vary by license
8	Backup	Independent backup of mail, OneDrive, SharePoint, Teams	Separate product
9	People	Onboarding and offboarding checklist	All plans
10	Training	Regular awareness training and phishing tests	Attack simulation needs Defender for Office 365 Plan 2 or add-on

1. Turn on multi-factor authentication for everyone

Stolen passwords are one of the most common ways attackers get into email. MFA means a password alone is not enough to sign in.

• Turn on security defaults, or, if you have Business Premium, use Conditional Access policies that require MFA.
• Require MFA for every human user account, including administrator accounts and dormant accounts that remain enabled. Avoid signing in directly to shared mailboxes; grant users access through their own accounts. Review service accounts separately, because automated processes may need to migrate to workload identities or use another supported authentication method.
• Prefer phishing-resistant MFA, such as FIDO2 security keys or passkeys; use stronger methods such as the Microsoft Authenticator app where supported, and avoid text-message codes when practical.

2. Protect administrator accounts

An administrator account can change everything in your tenant, so it is the account attackers want most.

• Give admins a separate admin account that they do not use for daily email.
• Minimize Global Administrator assignments and use least-privilege admin roles for day-to-day tasks, following Microsoft’s best practices for Entra roles.
• Require MFA on every admin account, with no exceptions.
• Maintain at least two emergency access (“break glass”) accounts so you can recover access if your normal administrator accounts are unavailable. Follow Microsoft’s guidance on phishing-resistant authentication, secure credential storage, monitoring, and periodic testing: emergency access account guidance.

3. Block legacy authentication

Legacy authentication uses older sign-in protocols that do not support modern authentication protections such as MFA. Microsoft has retired basic authentication for most Exchange Online protocols. Review sign-in logs for remaining dependencies, migrate affected applications and devices to modern authentication, and block legacy authentication using security defaults or appropriately configured Conditional Access policies.

4. Strengthen email protection

• Review anti-phishing, anti-spam and anti-malware policies in Microsoft Defender for Office 365 or Exchange Online Protection.
• Business Premium includes Safe Links and Safe Attachments, which check links and files when they are opened. Configure them where licensed, and verify coverage and policy settings for all intended users.
• Configure SPF, DKIM and DMARC for every domain you use to send email. These controls help receiving mail systems verify authorized senders and detect or reject spoofed messages. Configure DMARC alignment and move toward an appropriate enforcement policy after reviewing legitimate sending sources.
• Add an external sender warning so staff can see when a message comes from outside the company.
• Block automatic forwarding to outside addresses. Attackers often set up forwarding rules after they get into a mailbox.

5. Control sharing in SharePoint, OneDrive and Teams

• Decide whether files can be shared with “Anyone” links, which need no sign-in. Many businesses limit sharing to people they invite.
• Set expiration policies for “Anyone” links, which allow access without sign-in, and review guest-access expiration separately. Confirm whether existing links need to be replaced or reviewed when a new policy is introduced.
• Review guest access in Teams and remove guests who no longer need it.

6. Manage the devices that access company data

• With Microsoft Intune (included in Business Premium), you can manage supported computers and phones, enforce encryption and compliance policies, and use Conditional Access to restrict access to company resources based on device compliance. These protections require appropriate configuration, enrollment, and licensing.
• Turn on BitLocker for Windows laptops so a lost laptop does not mean lost data.
• Make sure you can remotely wipe company data from a lost or stolen phone.

7. Turn on logging and alerts

• Verify that Microsoft Purview audit logging is enabled. For Microsoft 365 Business plans, it is not on by default, so enable it if necessary, and check the retention period available under your licenses.
• Review alert policies, such as alerts for suspicious sign-ins or new forwarding rules, and make sure someone actually receives them.
• Check Microsoft Secure Score in the Defender portal. It lists recommended actions for your tenant and tracks progress.

8. Back up your Microsoft 365 data

Microsoft keeps the service running, but under its shared responsibility model, protecting your data is largely your job. Deleted items and retention settings are not the same as a separate backup. An independent backup of mailboxes, OneDrive, SharePoint and Teams lets you recover from accidental deletion, a departing employee or ransomware that reaches synced files. See our backup and disaster recovery services.

9. Handle people joining and leaving

• Use a written checklist for new hires so each account gets MFA and the right licenses from day one.
• When someone leaves, block sign-in promptly, revoke active sessions, review and remove authentication methods as appropriate, and transfer mailbox ownership or access according to your retention and business requirements. Remove unnecessary licenses and forwarding rules after preserving required data.

10. Train your staff

Settings stop a lot, but not everything. Short, regular security awareness training and phishing tests help staff recognize suspicious messages and report them.

Common mistakes we see

• MFA for “everyone” except a few. An owner’s account, a scanner’s mailbox or an old admin account is left out, and that is the one attackers find.
• Everyday work in an admin account. If that account is phished, the attacker has full control of the tenant.
• Former employees still licensed. Accounts stay active for months after someone leaves, sometimes still forwarding email.
• “Anyone” links everywhere. Sensitive files shared with no sign-in required, with links that never expire.
• Alerts no one reads. Alert policies exist but go to an unmonitored mailbox.
• Assuming Microsoft backs it up. Retention is mistaken for backup until a mailbox or site is gone.

How to check where you stand in an hour

If you are an administrator, these quick checks give you a picture of your tenant:

1. In the Microsoft 365 admin center, review Users > Active users for accounts that should not exist, and Roles for who holds Global Administrator.
2. In the Microsoft Entra admin center, check whether security defaults or Conditional Access policies are on, and review sign-in logs for legacy authentication.
3. In the Microsoft Defender portal, open Secure Score and look at the top recommended actions.
4. In the Exchange admin center, look for mail flow rules and mailbox forwarding to outside addresses.
5. In the SharePoint admin center, check the external sharing level for SharePoint and OneDrive.

Write down what you find. Even a short list gives you and your IT provider a clear starting point.

A worked example: tightening a 15-person tenant

A 15-person Omaha office on Business Standard licenses has MFA turned on for most users, two staff with Global Administrator on their daily accounts, and “Anyone” sharing enabled. A practical plan might be:

1. Review sign-in logs and identify devices or applications that rely on legacy authentication. Migrate or replace unsupported dependencies before enabling security defaults, then verify MFA registration and sign-in behavior for all applicable users.
2. Create separate admin accounts plus two emergency access accounts, and remove Global Administrator from the daily accounts.
3. Change sharing to “New and existing guests” and set link expiration.
4. Block external auto-forwarding and add SPF, DKIM and DMARC.
5. Add an independent Microsoft 365 backup and schedule restore tests.
6. Consider moving to Business Premium later for Conditional Access, Intune and Defender features.

Many of these changes can be made without new hardware, but the effort and potential disruption depend on your existing configuration, applications, devices, and licensing. Plan and test changes before enforcing policies across the organization.

What to ask your IT provider

• Which of these ten items are done in our tenant today, and can you show me?
• Who holds Global Administrator, and is it a separate account?
• Is legacy authentication blocked?
• Are SPF, DKIM and DMARC set up for every domain we send from?
• What is our current Secure Score, and what are the top actions to improve it?
• Is our Microsoft 365 data backed up outside Microsoft, and when was a restore tested?
• What happens to an account on the day someone leaves?

How Cambium Data can help

Serving Omaha businesses since 2009, Cambium Data manages Microsoft 365 tenants of all sizes. We can review your tenant against this checklist, explain what your license includes, and make the changes without disrupting your staff. Learn more about our cloud and Microsoft 365 services, contact us, or call (402) 514-3200.

Sources

• Microsoft Learn, Security defaults in Microsoft Entra ID
• Microsoft Learn, Best practices for Microsoft Entra roles
• Microsoft Learn, Manage emergency access accounts
• Microsoft Learn, Deprecation of Basic authentication in Exchange Online
• Microsoft Learn, Email authentication in Microsoft 365
• Microsoft Learn, Microsoft Secure Score
• Microsoft Learn, Shared responsibility in the cloud
• CISA, More than a Password

Frequently asked questions

Is Microsoft 365 secure by default?

Microsoft secures the service itself, but many protective settings in your tenant are off or need to be configured. Security defaults are on for many newer tenants, but older tenants and custom setups often need review.

Do I need Business Premium?

Not always. Business Premium adds Conditional Access, Intune and Defender features such as Safe Links. Many small businesses find it worth it for security, but the right license depends on your needs.

Does Microsoft back up my email?

Microsoft offers retention and recovery features for a limited time, but they are not the same as an independent backup. Many businesses add an independent Microsoft 365 backup.

What is Microsoft Secure Score?

Microsoft Secure Score evaluates your organization’s security posture against Microsoft’s recommendations and tracks improvement actions. It is a useful prioritization tool, not a guarantee that your tenant is secure or that it meets every compliance requirement.

TU

Tony Underwood

Founder, Cambium Data

Tony founded Cambium Data in 2009 and still leads the team. A Navy veteran with more than three decades in IT, he helps Omaha businesses run secure, dependable technology and put AI to practical use.

LinkedInsite.tonyunderwood.us