Microsoft 365 Security Checklist for Small Businesses

Why default Microsoft 365 settings are not enough

Microsoft builds Microsoft 365 to work out of the box for every type of organisation, so some protections that matter for a small business are left for the admin to switch on. Attackers know this. Typical Microsoft 365 takeovers combine a stolen password on an account without MFA, a hidden mailbox rule that forwards mail to an outsider, and an admin account with weak protection.

The checklist below is ordered by impact. Steps 1 to 4 stop most account takeovers; steps 5 to 8 help you detect and limit damage when something does go wrong. Your Microsoft 365 plan affects which settings you have: Business Premium adds Conditional Access, Intune and Defender for Office 365 Plan 1. Our guide to whether Business Premium is worth it explains the differences.

The Microsoft 365 security checklist, in priority order

Steps 1 to 4: stop account takeovers

1 and 2. MFA and blocking legacy authentication

Microsoft's security defaults require everyone to register for MFA, require admins to use MFA every sign-in, and block legacy authentication protocols that cannot do MFA (old mail apps using POP, IMAP or SMTP sign-in). Microsoft says tenants created on or after 22 October 2019 may already have them on. Check in the Entra admin centre under Properties. If you are on Business Premium and use Conditional Access instead, make sure your policies cover all users and block legacy authentication. Our MFA set-up guide walks through both.

3. Admin roles and break-glass accounts

Microsoft's role best practices recommend assigning Global Administrator to fewer than five people and keeping two cloud-only emergency access accounts. For a small business, that usually means the owner's everyday account is not a Global Admin. Use a separate admin account with strong MFA, give staff narrower roles (such as User Administrator) where needed, and store the break-glass credentials securely offline.

4. Automatic external forwarding

When attackers take over a mailbox, they often add a rule that forwards everything to an outside address, so they keep reading mail after you change the password. Microsoft's forwarding documentation explains that the default 'Automatic - System-controlled' setting behaves differently by organisation and recommends setting it explicitly. Set the outbound spam policy to Off - Forwarding is disabled, and create exceptions only for named mailboxes that genuinely need it.

Steps 5 to 8: detect and contain problems

5. Turn on audit logging

Microsoft's audit log page states that auditing is not enabled by default for small and medium business licences, including Business Basic, Standard and Premium. Without it, you cannot see who signed in, which rules were created or which files were accessed after an incident. Turn it on in the Microsoft Purview portal and check it shows as enabled.

6. Apply Defender preset security policies

Defender's preset security policies apply Microsoft's recommended anti-spam, anti-malware and anti-phishing settings in one go, plus Safe Links and Safe Attachments if you have Defender for Office 365. Assign the Standard preset to all users, and consider Strict for directors and finance staff who are prime targets for payment scams.

7. DKIM and DMARC

These DNS records stop others sending email that pretends to come from your domain, and help your own mail reach inboxes. Our guide to emails going to spam covers SPF, DKIM and DMARC step by step.

8. Limit external sharing

In the SharePoint admin centre, set the organisation-wide sharing level to 'New and existing guests' or stricter, and set 'Anyone' links to expire if you allow them at all.

Use Microsoft Secure Score to track progress

Microsoft Secure Score in the Defender portal measures your security posture; a higher number means more recommended actions completed. It lists actions with their point value and lets you mark ones you have addressed another way.

1. 1

   Open security.microsoft.com and go to Secure Score

   Sign in with an admin account. Note today's score so you can compare later.

2. 2

   Sort recommended actions by impact

   Focus on identity and email actions first; they match steps 1 to 6 above.

3. 3

   Fix, then re-check after a day

   The score updates in real time for some actions and syncs daily for others.

4. 4

   Record accepted risks

   If you deliberately skip an action, mark it with a reason so the next admin understands why.

5. 5

   Review monthly

   New recommendations appear as Microsoft adds features. A monthly look keeps the score from drifting.

Do not chase 100%. Some actions need licences you may not have, and a few are not practical for a five-person office. Use the score as a to-do list, not a target.

Ongoing checks every month

Security settings drift: staff join and leave, apps get connected, rules get added. A short monthly routine keeps the tenant tidy.

If you suspect an account has already been taken over, follow our hacked business email guide before changing settings, so evidence in the audit log is preserved. For backups, see whether you need to back up Microsoft 365.

Do it yourself or get help?

An admin who is comfortable in the Microsoft admin centres can work through steps 1 to 8 in a day. The risk is locking people out or missing a legacy app that breaks when old sign-in is blocked, so test with one user first and keep a break-glass account.

Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, blocks legacy sign-in and risky apps, cleans up admin roles with a break-glass account and gives you a before and after report. Email Threat Protection (S$290) tunes Defender for Office 365, impersonation protection and payment-scam rules.