Microsoft 365 Security Checklist for SMBs

Microsoft Secure Score is a built-in dashboard in the Microsoft 365 Defender portal that measures how well your tenant is configured against Microsoft's security recommendations. For a small business running Microsoft 365 Business Standard or Business Premium, a score between 60% and 80% represents a strong, defensible baseline. Under 30% indicates high risk and missing critical controls. Access it at security.microsoft.com → Secure Score.

Yes. Conditional Access requires Microsoft 365 Business Premium or an Entra ID P1 licence. If you are on Business Standard, you can use Security Defaults (free, included in all plans) to enforce MFA and block legacy authentication — but you lose the granular control Conditional Access provides. For most 5–50 employee businesses, the Business Premium upgrade is worth the cost given the security controls it unlocks.

Microsoft 365 provides a secure platform but ships in a permissive default state. Multi-factor authentication is available but not enforced. Legacy authentication protocols remain active. SharePoint external sharing may allow anonymous access. Admin accounts have no separation from daily work accounts. These defaults simplify initial setup but represent real, exploitable gaps in a live business tenant.

SPF specifies which mail servers are authorized to send email on behalf of your domain. DKIM adds a cryptographic signature to each outbound message, allowing receiving servers to verify the email was not tampered with in transit and genuinely originated from your domain. DMARC builds on both — it tells receiving servers what to do when a message fails SPF or DKIM checks. All three are needed for complete email authentication.

Canadian cyber insurers increasingly require enforced MFA on all users, endpoint detection and response (EDR), documented backups tested quarterly, a tested incident response plan, and evidence that legacy authentication is disabled. Insurers may also check for Conditional Access policies, DKIM/DMARC on sending domains, and audit logging. Missing controls can trigger coverage exclusions or denied claims after an incident.

No — not in the sense a business recovery plan requires. Microsoft protects the platform and provides limited retention features (Recycle Bin, version history, litigation hold), but under the shared responsibility model, your data is your responsibility. These convenience features cannot restore your tenant after ransomware encryption, an admin deletion, a departed employee, or a misconfiguration that wipes data. A dedicated third-party backup is required for genuine recovery capability.

Legacy authentication refers to older Microsoft 365 sign-in protocols — IMAP, POP3, basic SMTP auth, and older ActiveSync connections — that cannot enforce MFA. Regardless of your MFA policies, a stolen password alone grants mailbox access through these protocols. Microsoft's telemetry links legacy authentication to over 99% of password spray incidents. Disabling legacy auth is one of the highest-impact, lowest-effort controls you can enable.

Yes. Strong passwords are routinely stolen through phishing, credential stuffing, and info-stealer malware that captures keystrokes or browser-saved credentials. MFA blocks the overwhelming majority of automated account takeover attempts even after a password is compromised. It is now considered a baseline control by Canadian cyber insurers and regulators, not a premium add-on.

Traditional antivirus matches files against a database of known malware signatures. Endpoint detection and response (EDR) monitors device behaviour continuously — identifying suspicious activity patterns, isolating compromised devices, and supporting human-led investigation after an incident. Most cyber insurance policies now expect EDR-level protection rather than basic antivirus, which misses novel and fileless malware variants.

Most Canadian small businesses we work with spend between 3% and 8% of their IT budget on security controls — MFA, endpoint protection, email filtering, and third-party backup. The exact number depends on regulated data, cyber insurance requirements, and remote-work footprint. Microsoft 365 Business Premium consolidates many of these controls into a single licence, often reducing the per-control cost compared to purchasing them separately.

Preserve evidence first — do not delete logs or reimage machines. Isolate affected accounts by revoking active sessions in Entra ID (Revoke sign-in sessions). Reset credentials for impacted users. Check for malicious inbox forwarding rules and newly created email filters. Notify leadership and contact your managed IT or incident response provider before making further changes to the environment. If you have cyber insurance, notify your insurer early — most policies have reporting windows.

Short monthly phishing simulations plus quarterly micro-training consistently outperform a single annual session for small teams. Phishing tactics evolve quickly — monthly simulations keep recognition skills current without requiring long training blocks. Pair simulations with easy one-click reporting using the Microsoft "Report Message" Outlook add-in.