Article · Microsoft 365
A Microsoft 365 security checklist you can actually work through
Most Microsoft 365 tenants are not breached through exotic flaws. They are breached through weak sign-ins, over-privileged accounts and settings nobody revisited after setup. This checklist walks through the controls that matter most for a small or mid-sized organization, in a sensible order.
- Published
- 9 min read
On this page
Key takeaways
- Identity is the front door: enforce multifactor authentication for every account and move toward phishing-resistant methods for administrators.
- Block legacy authentication protocols, because they bypass modern sign-in protections entirely.
- Use separate, cloud-only administrator accounts with the narrowest role that does the job, and keep Global Administrator assignments to a small number.
- Treat Microsoft Secure Score as a to-do list to evaluate, not a score to maximize blindly.
- Restrict anonymous sharing links, external auto-forwarding and user consent to third-party apps.
- Confirm auditing is on and publish SPF, DKIM and DMARC records so your domain is harder to spoof.
Start with identity: MFA, security defaults and Conditional Access
Every Microsoft 365 tenant is protected first by Microsoft Entra ID, the identity service behind every sign-in. If an attacker can sign in as one of your users, most other controls become much less useful. That is why multifactor authentication (MFA) is the first item on any serious checklist, and why it needs to cover every account, including the shared or service-style accounts that are often forgotten.
Tenants without Entra ID P1 licensing can turn on security defaults, a Microsoft-managed bundle that requires MFA registration, challenges administrators more often and blocks legacy authentication. Security defaults are a reasonable floor, but they are all-or-nothing. Organizations licensed for Entra ID P1, which is included in Microsoft 365 Business Premium and the enterprise E3 and E5 plans, should replace security defaults with Conditional Access policies that can be tuned to the business.
A practical starting set of Conditional Access policies looks like this: require MFA for all users; require stronger, phishing-resistant authentication for administrator roles; block legacy authentication; require a compliant or hybrid-joined device for access to sensitive applications where device management is in place; and block or restrict sign-ins from countries where you have no staff, if that fits how your team travels. Build policies in report-only mode first, review the sign-in logs, then switch them on.
Always keep two emergency access (break-glass) accounts that are excluded from Conditional Access, protected with long random passwords or hardware security keys, stored securely, and monitored for any sign-in. Without them, a misconfigured policy can lock every administrator out of the tenant.
Choose stronger authentication methods
Not all MFA is equal. Attackers now routinely use adversary-in-the-middle phishing kits that capture a password and a one-time code together, then replay the session token.
Authenticator app with number matching
Microsoft Authenticator push notifications with number matching are a solid default for most staff and are much harder to approve by accident than a simple approve button.
Phishing-resistant methods
Passkeys, FIDO2 security keys and Windows Hello for Business are bound to the legitimate sign-in page and resist relay phishing. Prioritize them for administrators, finance staff and executives.
Retire SMS and voice where you can
Text and phone-call codes are better than nothing but are vulnerable to SIM swapping and interception. Use the authentication methods policy to disable them once users have registered something stronger.
Protect registration itself
Require that MFA registration happen from a trusted location or compliant device, or use a Temporary Access Pass for onboarding, so an attacker with a stolen password cannot register their own method first.
Close the legacy authentication gap
Legacy authentication refers to older protocols such as POP, IMAP, and basic-authentication SMTP that send a username and password without supporting modern MFA challenges. Microsoft has turned off basic authentication for most Exchange Online protocols, but authenticated SMTP submission, older multifunction printers, scanners and line-of-business applications still cause exceptions in many small offices.
Check the Entra ID sign-in logs and filter on client app to see which legacy clients are still connecting. Replace scan-to-email configurations with a supported option such as an SMTP relay connector restricted to your office IP address or a modern scanning service, then block legacy authentication with Conditional Access or security defaults. Disable SMTP AUTH at the organization level and only re-enable it on specific mailboxes that genuinely need it while you work on a replacement.
Lock down administrator access
Administrator accounts are the most valuable credentials in your tenant. Treat them differently from everyday accounts.
Separate admin accounts
Give each administrator a dedicated cloud-only account (for example, admin.firstname@yourtenant.onmicrosoft.com) without a mailbox licence. Do not read email or browse the web with it.
Least-privilege roles
Assign specific roles such as User Administrator, Exchange Administrator, Helpdesk Administrator or SharePoint Administrator instead of Global Administrator. Microsoft’s guidance is to keep Global Administrator assignments to a small handful, and it recommends fewer than five.
Just-in-time elevation where licensed
Privileged Identity Management (PIM) requires Entra ID P2, which comes with E5 or as an add-on. It makes roles eligible rather than permanent, so administrators activate them for a limited time with justification and MFA. Without P2, review role assignments manually every quarter.
Review partner and app access
Check delegated admin relationships (GDAP) with any IT provider, remove relationships you no longer need, and review enterprise applications that hold high-privilege Microsoft Graph permissions.
Use Microsoft Secure Score as a prioritized to-do list
Microsoft Secure Score, found in the Microsoft Defender portal, lists recommended actions across identity, devices, apps and data, with an estimate of the score impact and the user impact of each. It is a useful way to find settings you have not considered, and it tracks progress over time.
Read each recommendation before acting on it. Some actions depend on licences you may not have, some have significant user impact, and some can be marked as addressed by a third-party tool or risk-accepted with a written reason. The goal is not a perfect number; the goal is a documented decision for every recommendation. Review Secure Score monthly and after major changes, and record the actions you deliberately chose not to take.
Control sharing, forwarding and app consent
Data usually leaves a tenant through features working exactly as configured. These settings deserve a deliberate decision.
- SharePoint and OneDrive external sharing: set the organization-wide level to allow sharing only with new and existing guests, or tighter, and disable or expire Anyone links. Set the default link type to people in your organization.
- Guest access: require guests to authenticate, set guest access to expire, and periodically review guest accounts in Entra ID and Teams.
- Automatic forwarding: configure the outbound spam filter policy to block automatic external forwarding, then allow exceptions only for documented business needs. Attackers who compromise a mailbox commonly create forwarding rules to keep reading mail.
- User consent to applications: restrict users from consenting to third-party apps that request access to company data, and turn on the admin consent workflow so requests come to IT for review.
- Email threat protection: if you have Microsoft Defender for Office 365 Plan 1 (included in Business Premium), apply the Standard or Strict preset security policies to enable Safe Links, Safe Attachments and impersonation protection consistently.
- Sensitivity and retention: where licensed, publish sensitivity labels for confidential material and retention policies so deleted content can be recovered within your defined window.
Turn on auditing and authenticate your email domain
When something goes wrong, the audit log is how you find out what happened. Confirm that unified audit logging is enabled in Microsoft Purview and that mailbox auditing is on for all mailboxes, which Microsoft enables by default in current tenants but which is worth verifying, especially in older tenants. Note that audit retention depends on your licence; if you need a longer history, plan to export logs or license accordingly.
Email authentication protects your domain from being used to impersonate you. Publish an SPF record listing the services that legitimately send mail as your domain, enable DKIM signing for each custom domain in the Defender portal, and publish a DMARC record. Start DMARC at p=none with reporting so you can see who is sending as your domain, fix any legitimate senders such as your accounting software or newsletter platform, then move to p=quarantine and eventually p=reject. Large mailbox providers increasingly expect bulk senders to have SPF, DKIM and DMARC in place, so this also helps deliverability.
Finally, configure alert policies for high-risk events such as new inbox forwarding rules, elevation of privilege and unusual file deletion, and make sure someone actually receives and reviews them during business hours.
Work through it in stages
You do not need to do everything in one weekend. A sensible order is MFA for everyone, emergency access accounts, admin account separation, legacy authentication blocked, then sharing, forwarding, auditing and email authentication. Record what you changed and why so the next person can follow your reasoning.
Frequently asked questions
Are security defaults enough for a small business?
Security defaults are a sensible baseline for tenants without Entra ID P1. They require MFA registration and block legacy authentication. If you have Business Premium or another plan with P1, Conditional Access gives you finer control, such as requiring compliant devices or stronger methods for administrators.
Do we need Microsoft 365 E5 to secure our tenant properly?
No. Most of the controls in this checklist are available in Microsoft 365 Business Premium or even in lower plans. E5 adds capabilities such as Privileged Identity Management and longer audit retention, which some organizations will value, but the fundamentals do not depend on it.
How often should we review Microsoft 365 security settings?
Review Secure Score and admin role assignments monthly or quarterly, review guest accounts and sharing links at least quarterly, and revisit Conditional Access whenever you add a new application, office or remote-work arrangement.
Will blocking legacy authentication break our printers or apps?
It can, which is why you check the sign-in logs first. Scanners and older apps that use basic-authentication SMTP usually need a relay connector or a supported alternative before the block is enforced.
Related services
Products and packages
Find out where your tenant stands
A Microsoft 365 security assessment reviews sign-in policies, admin roles, sharing and email authentication against this checklist and gives you a written, prioritized list of fixes.