Microsoft 365 Security Checklist for Small Businesses (2026)

Microsoft Secure Score is a built-in dashboard in the Microsoft 365 Defender portal that measures how well your tenant is configured. It gives you a number — and more usefully — a prioritized list of exactly what to fix next. Access it at security.microsoft.com → Secure Score.

Review your Secure Score monthly. Use the Improvement Actions tab to see a prioritized list — each action shows the point value, implementation difficulty, and exact portal location.

Every control in this checklist belongs to one of four protection layers. No single layer stops everything — all four working together is what creates a defensible posture.

Check items as you complete them — your progress is saved in your browser.

Enforcing MFA across every Microsoft 365 account is the single highest-impact control available to a small business. Passwords alone are routinely stolen through phishing, credential stuffing, and info-stealer malware. MFA blocks the overwhelming majority of automated account takeover attempts — and its absence is the most common reason cyber insurance claims are denied after a breach.

Legacy authentication protocols — IMAP, POP3, basic SMTP auth, and older Exchange ActiveSync — cannot enforce MFA. A stolen password alone grants mailbox access through these protocols regardless of what MFA policies are set elsewhere in the tenant.

Conditional Access is the policy engine that controls how, from where, and from what devices your team can sign into Microsoft 365. A small set of well-configured policies delivers significant protection beyond Security Defaults alone.

Global administrators have unrestricted access to your entire Microsoft 365 environment — including the ability to reset any password, delete data, remove audit logs, and disable security policies. Compromise of a single global admin account is effectively a complete tenant takeover.

Phishing is the leading cause of Microsoft 365 account compromise in small businesses. Defender anti-phishing capabilities go well beyond basic spam filtering — but require configuration to be effective. A default tenant has minimal protection. A configured tenant has impersonation detection, mailbox intelligence, and first-contact safety tips active.

Safe Links checks URLs at the moment a user clicks — not just at delivery — catching links that turned malicious after reaching the inbox. Safe Attachments detonates suspicious files in an isolated sandbox before delivering them, blocking malware that signature-based scanning misses.

SPF, DKIM, and DMARC are DNS-level email authentication standards. Together they prove email from your domain is genuine — and instruct receiving servers what to do with messages that fail the check. Without all three, anyone can send convincing spoofed email appearing to come from your domain.

Mailbox auditing records a log of every action in each user's mailbox — who accessed it, what was read, what was deleted, and whether forwarding rules were added. Without it, a post-breach investigation has nothing to work with.

By default, Microsoft 365 allows users to share any file with anyone via a link requiring no sign-in. Guest accounts added for contractors often persist long after the engagement ends. These two defaults represent a quiet but significant data exposure risk.

Unified audit logging captures activity across Exchange, SharePoint, Teams, and Entra ID. Alert policies trigger notifications on high-risk events. Together they are the foundation of any incident detection capability — and increasingly expected by cyber insurers as evidence of monitoring.

Technical controls reduce the attack surface — but a convincing phishing email still reaches inboxes. Staff training is the last line of defence. The goal is not to eliminate all clicks; it is to make suspicious emails reportable, normalize asking for help, and ensure staff know what to do in the first 15 minutes after clicking something suspicious.

• Run short monthly phishing simulations (Microsoft Attack Simulator, included in Business Premium) — frequency beats length
• Install the Microsoft "Report Message" Outlook add-in — reporting should be one click
• Make it explicitly safe to report a click without fear of blame — reported incidents are easier to contain than hidden ones
• Train staff to recognize: invoice fraud, Microsoft 365 login spoofs, CEO impersonation
• Document what to do immediately after clicking: who to call, whether to close the browser, whether to shut down the device

Endpoints — laptops, desktops, phones, tablets, including personal BYOD devices — are the second primary attack surface alongside email. Built-in Windows Defender provides a baseline but is not sufficient for businesses with remote workers, BYOD devices, or active cyber insurance obligations. Microsoft Defender for Business (included in Business Premium) provides EDR-level protection managed through Intune.

Pair this guide with our managed security and firewall service for hands-on EDR deployment and tenant hardening.

The Recycle Bin, OneDrive version history, and SharePoint retention policies are convenience recovery features — not backups. They have short windows, can be wiped by a compromised admin account, and do not protect against ransomware encryption.

Ransomware attacks almost always follow the same path: a phishing email compromises a credential, the attacker moves laterally, then deploys encryption. Every stage of that chain is breakable — MFA stops credential-only attacks, endpoint protection detects lateral movement, Safe Attachments blocks malicious payloads, and backup provides the recovery path.

• Enforce least-privilege on both user and admin accounts — limit the blast radius of any compromised identity
• Apply the 3-2-1 rule: three copies of data, two media types, one copy outside the production tenant
• Test restores quarterly and document results — an untested backup is not a backup
• Write down who makes decisions in the first 60 minutes of an incident, before you need it
• Confirm your cyber insurance policy's position on ransom payment in advance

These are the issues we encounter most frequently when auditing a new client's tenant. None require expensive tools to fix — they require configuration and attention.

We offer a structured Microsoft 365 tenant security review for small businesses. It is not a sales call — it is a technical audit of your tenant configuration against the controls in this checklist, delivered as a written report you can act on with or without our ongoing involvement.

Next Steps

Start with the CRITICAL-tagged controls at the top of the checklist — MFA enforcement, legacy authentication blocking, admin account separation, and backup. These deliver the highest impact and are most frequently checked by cyber insurers. Then work through HIGH-rated email security and endpoint controls. Schedule a quarterly Secure Score review to catch drift.

Security is a posture, not a one-time project. The practical goal for a 5–50 person business is a documented, maintainable Microsoft 365 security baseline — not perfection.