Microsoft 365 holds most small businesses' email, files, and user accounts, which makes it the most valuable thing an attacker can get into. Many tenants are set up quickly and never revisited. This checklist covers the settings that matter most, roughly in order of impact.
Sign-in protection
- Require multi-factor authentication for everyone. Use security defaults if you don't have Microsoft Entra ID P1 licensing, or Conditional Access policies if you do.
- Block legacy authentication. Older sign-in methods can't use MFA, so attackers target them. Security defaults block them automatically, and Conditional Access can do the same.
- Prefer an authenticator app over text messages. App-based approval with number matching is harder to intercept than a code sent by SMS.
Administrator accounts
- Use separate admin accounts. Administrators should do daily work with a normal account and sign in with a dedicated admin account only when needed.
- Keep Global Administrators to a minimum. Microsoft recommends fewer than five. Assign narrower roles, such as User Administrator or Exchange Administrator, wherever possible.
- Create an emergency access account. A protected, documented "break glass" account prevents a lockout if your normal sign-in method fails.
- Turn on Microsoft's preset security policies. The Standard or Strict presets apply recommended anti-spam, anti-phishing, and anti-malware settings in one step.
- Publish SPF, DKIM, and DMARC. They make it harder for attackers to send email pretending to be you, and help your email reach inboxes.
- Block automatic forwarding to outside addresses. Attackers who take over a mailbox often set up forwarding rules to quietly copy mail. Outbound spam policies can prevent external auto-forwarding.
Files and sharing
- Review external sharing settings. Decide whether SharePoint and OneDrive links can be shared with anyone, only with signed-in guests, or not externally at all, and set link expiration where it makes sense.
- Restrict app consent. Prevent users from granting third-party apps access to company data without an administrator's review. Consent phishing tricks people into approving malicious apps.
Visibility and recovery
- Confirm audit logging is on and review alerts. Audit logs record sign-ins and changes, which is essential if you ever need to investigate an incident.
- Back up Microsoft 365 data. Built-in retention helps with everyday mistakes, but a separate backup protects against ransomware, malicious deletion, and expired retention windows.
Where to start
If you can only do three things this week, enforce MFA for every account, separate your administrator accounts, and publish SPF, DKIM, and DMARC. Those changes close the paths behind a large share of small business compromises.
Make changes with a plan. Tell your team what's coming, roll out MFA in stages if needed, and test before enforcing anything that might block legitimate sign-ins or email.
Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.
Need help with this?
Albano Tech provides Microsoft 365 Management & Migrations for businesses in Delaware, Maryland, and the Philadelphia region.