Microsoft 365 Security Checklist for SMBs (2026)

A Microsoft 365 security checklist for a small or mid-sized business comes down to a short list of settings that stop most real attacks: enforce MFA for every user (Security Defaults or Conditional Access), block legacy authentication, cut the number of Global Administrators, turn on Defender for Office 365 Safe Links and Safe Attachments, publish SPF, DKIM and DMARC, block automatic external forwarding, confirm audit logging is on, require compliant devices, restrict external sharing and back up your Microsoft 365 data. Most of these need Microsoft 365 Business Premium; a few work on any plan.

The order matters. Identity controls come first because most Microsoft 365 breaches start with a stolen password or session, not a software exploit.

First, check your license

Many SMBs try to secure Microsoft 365 on Business Basic or Standard and find the controls they need aren't there. Microsoft's own Microsoft 365 for business security overview lays out the split:

Business plans are capped at 300 users. Business Premium customers can buy the Microsoft Defender Suite add-on, which brings Entra ID P2, Defender for Office 365 Plan 2, Defender for Endpoint Plan 2, Defender for Identity and Defender for Cloud Apps.

1. Identity: MFA, Conditional Access and legacy authentication

• Enforce MFA for every account. On Basic or Standard, keep Security Defaults switched on. It requires all users to register for MFA, forces MFA for administrators, and blocks legacy authentication (Microsoft Learn: security defaults).
• On Business Premium, move to Conditional Access. Security Defaults is on or off with no exceptions. Conditional Access lets you require MFA for all users, block legacy authentication, require stronger MFA for admins and require a compliant device for access. You must turn Security Defaults off when you replace it with Conditional Access policies, so build and test the policies first.
• Block legacy authentication explicitly. Older protocols such as POP, IMAP and basic-auth SMTP can't do MFA, so an attacker with a password can walk straight past your MFA policy. Check sign-in logs for legacy clients before you block, and move scanners and line-of-business apps that send mail onto a supported method. Microsoft is retiring basic authentication for SMTP AUTH as well.
• Use phishing-resistant MFA for high-risk users. FIDO2 security keys or passkeys for admins, finance and executives defeat the adversary-in-the-middle phishing kits that steal session tokens.
• Create two emergency access ("break glass") accounts. Microsoft recommends two cloud-only accounts with Global Administrator, excluded from normal policies, with long passwords stored securely and sign-ins alerted.

Azure and admin portals now require MFA as well. See our guide to Microsoft's mandatory MFA for Azure.

2. Admin roles and privileged access

• Keep Global Administrators to a minimum. Microsoft recommends fewer than five. Most day-to-day work can be done with narrower roles such as Exchange Administrator, User Administrator or Helpdesk Administrator.
• Separate admin accounts from daily accounts. Admins should not read email or browse the web with the account that can change tenant settings. Admin accounts should be cloud-only, not synced from on-premises Active Directory.
• Use Privileged Identity Management (PIM) if you can. PIM makes admin roles just-in-time: an admin activates the role for a set time, with MFA and a justification, and the activation is logged. PIM needs Microsoft Entra ID P2 or Entra ID Governance, so it isn't in Business Premium alone. The Defender Suite add-on includes Entra ID P2.
• Review admin role membership every quarter, including any partner or former-provider access (GDAP relationships and guest accounts).

3. Email: Defender for Office 365, authentication and forwarding

• Apply the Standard or Strict preset security policies. In the Microsoft Defender portal, preset policies switch on Microsoft's recommended settings for anti-phishing, Safe Links and Safe Attachments in one step and stay current as Microsoft updates them. Put executives and finance staff in Strict.
• Safe Links rewrites and checks URLs at click time in email, Teams and Office apps. Safe Attachments detonates attachments in a sandbox before delivery and can scan files in SharePoint, OneDrive and Teams.
• Turn on impersonation protection for your executives and your own domains, so look-alike senders are flagged.
• Publish SPF, enable DKIM and enforce DMARC. DKIM signing for your custom domain has to be switched on; it isn't automatic. Start DMARC at p=none with reporting, fix legitimate senders (marketing platforms, CRMs, invoicing tools), then move to p=quarantine and p=reject. Our email security guide for SMBs covers the rollout.
• Block automatic external forwarding. Attackers who compromise a mailbox often add an inbox rule that forwards mail out. In the outbound spam policy, set automatic forwarding to Off rather than leaving it on "Automatic - System-controlled", whose behavior varies by tenant (Microsoft Learn: external email forwarding). Allow exceptions by named user or remote domain only.

4. Logging and alerting

• Confirm the unified audit log is on. Microsoft Purview Audit (Standard) is enabled by default and keeps records for 180 days (Microsoft Learn: auditing solutions). Check it hasn't been disabled, particularly in older tenants.
• Keep logs longer than 180 days if you have regulatory or insurance obligations. Audit (Premium) extends retention, or you can stream logs to a SIEM. Attackers are often inside for weeks before anyone notices.
• Alert on the events that matter: new inbox rules that forward or delete, MFA method changes, new admin role assignments, OAuth app consents with mail access, and sign-ins from unusual countries.
• Someone has to read the alerts. Alerts that land in an unmonitored mailbox don't stop anything. That's the gap managed security (MSSP) services fill with 24/7 monitoring.

5. Devices: Intune and device compliance

• Enrol company laptops and phones in Intune and define compliance policies: supported OS version, disk encryption (BitLocker or FileVault), a screen lock and Defender running.
• Require a compliant device in Conditional Access for access to email and files, at least for admins and staff handling sensitive data. A stolen password alone then isn't enough.
• Use app protection policies for personal phones (MAM) so company data stays in managed apps and can be wiped without touching personal data.
• Onboard devices to Defender for Business for endpoint detection and response, and turn on attack surface reduction rules.

6. Data: external sharing and backup

• Tighten SharePoint and OneDrive sharing. At organization level, allow sharing with "New and existing guests" rather than "Anyone" links unless you have a clear need. Set the default link type to "Specific people", and if you keep Anyone links, give them an expiry.
• Review guest accounts regularly and remove those no longer needed.
• Back up Microsoft 365 data. Retention policies and the recycle bin are not a backup, and ransomware or a malicious admin can delete or encrypt synced content. Use a third-party backup, or Microsoft 365 Backup, a pay-as-you-go service covering Exchange, OneDrive and SharePoint. Test a restore at least once a year.

7. Measure it: Microsoft Secure Score

Microsoft Secure Score, in the Defender portal, rates your tenant against Microsoft's recommended controls and lists the next actions by impact. Use it as a to-do list, not a target. Some recommendations need licenses you don't have, and some can be marked as covered by a third-party tool. Review it monthly so you notice when a setting drifts.

A 30-day order of work

1. Week 1: MFA for everyone, legacy authentication blocked, break-glass accounts created, Global Admins reduced.
2. Week 2: Preset security policies, external forwarding off, SPF and DKIM in place, DMARC at p=none with reporting.
3. Week 3: Audit log confirmed, alerts configured and routed to someone who responds, sharing settings tightened.
4. Week 4: Intune compliance policies, compliant-device Conditional Access for admins, backup in place and a test restore.

Then move DMARC to enforcement and extend device compliance to all staff. Identity hardening is covered in more depth in our identity and access management guide. If an account has already been compromised, follow the BEC first-24-hours checklist.

Who should own this?

These settings aren't set-and-forget. Microsoft changes defaults, staff join and leave, and new apps request permissions. Smaller businesses usually hand the tenant to a managed IT provider. Companies with an internal IT person often keep day-to-day administration and use co-managed IT for security hardening, monitoring and after-hours cover.

Frequently Asked Questions

Is Microsoft 365 Business Premium worth it for security?

For most SMBs, yes. It adds Conditional Access (Entra ID P1), Intune, Defender for Office 365 Plan 1 and Defender for Business, which cover the controls on this checklist that Basic and Standard can't.

Should we use Security Defaults or Conditional Access?

Use Security Defaults if you don't have Entra ID P1. If you have Business Premium, Conditional Access gives you exceptions, device-based rules and stronger MFA for admins. You must turn Security Defaults off when Conditional Access replaces it.

Does Microsoft back up our Microsoft 365 data?

Microsoft keeps the service resilient, but retention settings and recycle bins are not a backup you control. Use a third-party backup or Microsoft 365 Backup, which is billed separately.

Why block automatic email forwarding?

Attackers who take over a mailbox often add a rule that forwards mail to an outside address, letting them watch payments and conversations. Blocking external auto-forwarding closes that route.

What is a good Microsoft Secure Score?

There's no universal pass mark. Treat it as a prioritized list and work through the high-impact identity and email actions first.

How often should we review Microsoft 365 security settings?

Check Secure Score and alerts monthly, admin roles and guest access quarterly, and the full checklist at least once a year or after any incident.

Want this checklist applied and kept current? Defensible provides managed IT, managed security and co-managed IT for Microsoft 365 tenants, and a senior responder engages within one hour if an incident occurs. Explore Managed IT Services or get started.