Microsoft 365 Security Checklist for Small Business

Start with identity, in this order

The short answer: secure identities first (phishing-resistant MFA and admin hygiene), then email (SPF, DKIM, DMARC, and anti-phishing policies), then data (sharing settings, audit logging, and backup). That order matters because most Microsoft 365 compromises begin with a stolen sign-in, not a hacked server. This checklist walks through each control in priority order: what it is, why it matters, and where to click, verified against current Microsoft documentation.

This guide is specific to Microsoft 365. For the broader program (endpoints, Wi-Fi, training, insurance), pair it with our small business cybersecurity checklist and the full business cybersecurity guide.

What you can turn on at each license tier

Not every control below is available on every plan. Here is the honest map, based on Microsoft Entra licensing and the Defender for Office 365 service description:

Control	Business Basic / Standard	Business Premium
MFA, passkeys, Microsoft Authenticator	Included	Included
Security defaults	Included	Included (or use Conditional Access)
Conditional Access (Entra ID P1)	Not included	Included
SPF, DKIM, DMARC	Included (DNS records)	Included (DNS records)
Exchange Online Protection (anti-spam, anti-malware)	Included	Included
Defender for Office 365 Plan 1 (Safe Links, impersonation protection)	Add-on	Included
SharePoint/OneDrive/Teams sharing controls	Included	Included
Audit logging (Purview Audit Standard)	Included	Included
Intune device management	Not included	Included
Defender for Business (endpoint)	Not included	Included
Point-in-time backup	Add-on (any plan)	Add-on (any plan)

If you are choosing between plans, Business Premium is where the security tooling lives. Everything in the “do first” phase below works on any plan, though.

Phase 1: Do first

These four items close the doors attackers actually use. If you do nothing else this quarter, do these.

Turn on MFA for every user, and start the move to passkeys

MFA is the single highest-value control in this list, but the method matters. Texted codes can be phished or SIM-swapped, which is why Microsoft is retiring its SMS and voice authentication methods: passkeys become the default on September 1, 2026, and Microsoft-provided SMS and voice retire fully on February 1, 2027. We covered the full retirement timeline and migration plan separately; the practical takeaway is to move people to phishing-resistant methods now rather than waiting for the blocking prompt.

Where to click: in the Microsoft Entra admin center, go to Protection, then Authentication methods, and enable passkey (FIDO2) alongside Microsoft Authenticator. Then run Microsoft’s “Find users still using SMS or Voice” report so you know who is exposed. If a provider manages your tenant, ask them for that user list and a passkey rollout date.

Decide: security defaults or Conditional Access

Security defaults are Microsoft’s free baseline, on by default for new tenants: they require MFA registration for all users, require MFA for admins, and block legacy authentication protocols that cannot do MFA at all. If you are on Business Basic or Standard, confirm they are enabled (Entra admin center, then Identity, then Overview, then Properties) and stop there.

Conditional Access is the upgrade path, and it requires Entra ID P1, which is included in Business Premium. It gives you the same protection as security defaults plus granularity: require phishing-resistant MFA for admin roles, block sign-ins from countries you never operate in, or require a compliant device before opening SharePoint. The two are mutually exclusive; you turn off security defaults when your Conditional Access policies are ready, never before. If someone runs your tenant for you, ask which of the two is active. The answer “neither” is the wrong answer.

Clean up admin accounts

Every Global Administrator account is a master key. Microsoft’s own guidance for Entra roles is to keep fewer than five Global Administrators and to assign less-privileged roles (Exchange Administrator, User Administrator, Helpdesk Administrator) for day-to-day work. Admins should have a separate admin account, not admin rights on the mailbox they read email with, because the account that opens phishing mail should never be the account that can reset the whole company.

Also create two cloud-only emergency access accounts (often called break-glass accounts) with long random passwords stored offline, excluded from Conditional Access, so a bad policy or a lost phone can never lock you out of your own tenant.

Where to click: Entra admin center, then Identity, then Roles and admins, then Global Administrator, and review the member list. Ask your IT provider for the same list quarterly.

Check your Secure Score

Microsoft Secure Score (in the Defender portal at security.microsoft.com) grades your tenant against Microsoft’s recommended actions and tells you exactly which gaps remain. It is not a guarantee of anything, and Microsoft says as much, but it is a free, tenant-specific to-do list and a useful way to measure progress on everything else in this article.

Phase 2: Do soon

Identity is locked down. Now harden the front door attackers knock on every day: email.

Publish SPF, DKIM, and DMARC for your domain

These three DNS records prove that mail claiming to come from your domain actually does, which is what makes spoofing your CEO’s address hard. Email authentication in Microsoft 365 works as a chain: SPF lists which servers may send for your domain, DKIM cryptographically signs each message, and DMARC tells receiving servers what to do when a message fails both.

Where to click: SPF and DMARC are TXT records at your DNS host (Cloudflare, GoDaddy, wherever your domain lives). DKIM is enabled per domain in the Defender portal under Email authentication settings. Start DMARC at p=none to monitor reports, then move to p=quarantine and p=reject once legitimate senders (your CRM, your newsletter tool) are accounted for. This is a one-time project with permanent payoff, and it is a reasonable thing to hand to your IT provider in a single sentence: “set up SPF, DKIM, and DMARC, and get us to reject.”

Configure anti-phishing protection in Defender for Office 365

Every Microsoft 365 mailbox gets Exchange Online Protection (anti-spam and anti-malware) automatically. But the anti-phishing features that catch impersonation, such as a lookalike of your CFO’s display name or a domain one letter off from yours, require Defender for Office 365 Plan 1, included in Business Premium and available as an add-on elsewhere. Critically, impersonation protection is not configured in the default policy: you have to turn it on.

The fastest safe route is Microsoft’s Standard preset security policy, which applies Microsoft’s recommended anti-phishing, Safe Links, and Safe Attachments settings in one step instead of hand-tuning a dozen policies. Where to click: Defender portal, then Email and collaboration, then Policies and rules, then Threat policies, then Preset security policies. Add your executives to the user impersonation protection list while you are there.

Prevvi runs layered email security for clients (Proofpoint in front of these Microsoft controls) as part of our cybersecurity services, because filtering phishing before it reaches an inbox beats cleaning up after it. If you want a second set of eyes on your tenant’s current settings, a free assessment takes less time than reading this article did.

Rein in external sharing and guest access

By default, SharePoint and OneDrive allow fairly open sharing, and Teams invites create guests. That is convenient right up until an “anyone with the link” URL to your payroll folder gets forwarded. Microsoft documents the full set of controls in its guide to limiting sharing across Microsoft 365 and the guest sharing settings reference.

The pragmatic middle ground for most small businesses: in the SharePoint admin center under Policies, then Sharing, set the organization default to “New and existing guests” rather than “Anyone,” so external recipients must authenticate; make sharing links default to “Specific people”; set an expiration on guest access; and restrict the most sensitive sites to “Only people in your organization” using site-level sharing settings. What to ask your provider: “What is our tenant-wide sharing level, and which sites are locked down tighter?” If they cannot answer quickly, nobody has looked.

Phase 3: Mature the tenant

These items separate a tenant that is hardened from a tenant that can also prove what happened and recover when something goes wrong.

Confirm audit logging is on and alerts are flowing

You cannot investigate what you did not record. Microsoft Purview auditing is enabled by default and, on the Standard tier every business plan includes, retains audit records for 180 days: sign-ins, mailbox rules, file access, sharing events, admin changes. Verify it is actually on (Purview portal, then Audit; if a “start recording” banner appears, click it) because an inherited or older tenant may have had it turned off.

Pair the log with alert policies in the Defender portal. Default policies, on automatically, already flag things like malware campaigns, unusual external sharing, and new admin role assignments; make sure the email notifications go to a mailbox a human reads, not a former employee’s. The classic post-breach finding is a malicious inbox-forwarding rule that an alert flagged to an unmonitored address.

Face the shared responsibility reality: backup is yours

Microsoft’s shared responsibility model is explicit: even in SaaS, you own your data and identities. Microsoft keeps Exchange, SharePoint, and Teams running on redundant infrastructure, but service resilience is not the same as your ability to restore last Tuesday’s version of a mailbox after ransomware encrypts a synced library or a departing employee empties a site. Recycle bins and retention windows are time-limited and can be emptied.

Microsoft’s own answer to this gap is Microsoft 365 Backup, a pay-as-you-go product with point-in-time restore for OneDrive, SharePoint, and Exchange and a one-year retention period; third-party tools (Prevvi uses Keepit, with restores we actually test) cover the same need. Whichever route you take, the checklist item is the same: have a backup that is independent of the tenant’s own recycle bin, and restore something from it at least quarterly to prove it works.

Manage the devices that touch your data

A perfectly hardened tenant still leaks through an unencrypted personal laptop with a cached OneDrive folder. If you have Business Premium, you already own Microsoft Intune: use it to enroll company devices, require disk encryption and screen locks, push updates, and wipe company data off a lost phone. Combined with Conditional Access, you can require a compliant or protected device before Microsoft 365 opens at all. On Basic or Standard, you lack Intune, which is a real argument for the Premium upgrade once identity and email are handled; in the meantime, at minimum enforce MFA everywhere and keep an inventory of which devices hold company data.

Keep it maintained, not just configured

A tenant hardens on a Tuesday and drifts by December: new hires skip MFA registration, a project team opens sharing “temporarily,” an app gets admin consent nobody remembers. Put a quarterly recurring task on the calendar to re-check Secure Score, the Global Administrator list, sharing settings, and a test restore. If that cadence is not going to happen internally, that is exactly the gap a managed provider fills: this checklist is standard onboarding work in Prevvi’s cybersecurity services, monitored continuously afterward from our Cambridge, Massachusetts team with a 15-minute median response time.

Next step

Work the phases in order: identity this week, email this month, logging and backup this quarter. None of it requires new licenses until you hit Conditional Access and Intune, and every item above links to the Microsoft doc that shows the exact clicks.

If you would rather see where your tenant stands before touching anything, book a free assessment: we will review your MFA methods, admin roles, email authentication, sharing posture, and backup coverage, and hand you the prioritized gap list even if you fix it yourself.