Microsoft 365 Security Checklist for Small Businesses (2026)

Each item below says what the setting is, why it matters and where to check it. Some cost nothing. Others need a particular plan, and we say which.

1. Multifactor authentication (MFA)

MFA asks for a second proof of identity, such as an app prompt, when someone signs in. A stolen password is then not enough on its own. Microsoft says MFA plus blocking legacy authentication stops more than 99.9% of common identity-related attacks.

The free route is security defaults. They require every user to register for MFA and require administrators to use it. Check them in the Microsoft Entra admin center under Entra ID > Overview > Properties > Manage security defaults. It should read Enabled.

The better route is Conditional Access, which lets you write your own rules. It needs Microsoft Entra ID P1, which Microsoft 365 Business Premium includes. You will find it under Entra ID > Conditional Access > Policies. Turn security defaults off before your policies replace them.

2. Administrator accounts

Global Administrators can change almost every setting in your tenant. Microsoft recommends giving that role to fewer than five people. Give anyone who only resets passwords or manages billing a narrower role.

Admins should also use separate accounts for administration and for everyday work such as email. If the everyday account is phished, it holds no admin rights. Microsoft also recommends two cloud-only emergency access accounts, so you can recover if everyone else is locked out.

Where to check: Entra ID > Roles & admins > All roles, then open Global Administrator. Old accounts nobody uses are a risk too, and our guide to finding unused Microsoft 365 licences shows how to list them.

3. Legacy authentication

Legacy authentication covers older mail protocols such as IMAP, SMTP and POP3, and clients such as Office 2010. It cannot do MFA, so an attacker can use it to sidestep the MFA you switched on. Security defaults block it.

With Conditional Access, create a policy under Entra ID > Conditional Access > Policies > New policy. Under Conditions > Client apps, select Exchange ActiveSync clients and Other clients. Set the grant to Block access.

Start in Report-only mode, so scanners and older apps that send email do not stop working unannounced. To see who still uses legacy sign-ins, open Entra ID > Monitoring & health > Sign-in logs and add the Client App column.

4. External sharing in SharePoint and OneDrive

This setting decides who outside your business can open your files. The loosest option, Anyone, creates links that work without signing in.

Where to check: SharePoint admin center, Policies > Sharing. Under External sharing, the choices run from Anyone through New and existing guests and Existing guests to Only people in your organization. OneDrive can be set tighter than SharePoint, but never looser.

If you do not need Anyone links, choose New and existing guests or stricter. If you keep Anyone, require links to expire and limit them to View permission.

5. Email authentication: SPF, DKIM and DMARC

These three checks help stop other people forging email from your domain.

• SPF lists the servers allowed to send your mail.
• DKIM digitally signs your outgoing messages.
• DMARC tells receiving servers what to do with mail that fails, and sends you reports.

Microsoft describes them as interdependent building blocks, so set up all three.

SPF and DMARC are DNS records. You set them wherever your domain's DNS is hosted, usually your domain registrar or web host. If Microsoft 365 is your only sender, the SPF record reads v=spf1 include:spf.protection.outlook.com -all. If anything else sends mail for you, such as a scanner or CRM, add it to the record first. Start DMARC at p=none and watch the reports before moving to quarantine and then reject.

For DKIM, publish two CNAME records at your DNS host. Then switch signing on in the Microsoft Defender portal. Go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then the DKIM tab.

6. Anti-phishing and Defender for Office 365

Every Microsoft 365 mailbox has built-in spam, malware and anti-phishing protection. Defender for Office 365 Plan 1 adds impersonation protection, Safe Links and Safe Attachments. Business Premium includes Plan 1, and many other plans can add it as an extra.

Where to check: Microsoft Defender portal, Email & collaboration > Policies & rules > Threat policies > Preset Security Policies. Microsoft notes that Standard protection and Strict protection are likely off on your first visit. Standard is a sensible starting point.

7. Unified audit log

The unified audit log records user and admin activity across Microsoft 365. It is how you work out what happened after a suspected breach.

Microsoft's documentation says auditing is not on by default for Business Basic, Business Standard or Business Premium. Check it rather than assume.

Where to check: open Audit in the Microsoft Purview portal. A banner reading Start recording user and admin activity means auditing is off. Select it and allow up to 60 minutes for the change to apply, and a few hours before events show in searches. Audit (Standard) keeps records for 180 days.

8. Microsoft Secure Score

Secure Score turns your settings into a number, where higher means more recommended actions completed. It works as a ready-made to-do list.

Where to check: Microsoft Secure Score in the Microsoft Defender portal, at security.microsoft.com/securescore. You need a role such as Security Administrator to act on it. Microsoft stresses the score is not a guarantee against breach.

9. Device management with Intune

Intune lets you set rules for laptops and phones, such as a minimum operating system version. Paired with Conditional Access, a device that breaks the rules can be blocked from company data.

Microsoft says Business Premium includes full Intune capabilities. Other plans may not, so confirm yours first.

Where to check: Microsoft Intune admin center, Devices > Manage devices > Compliance > Create policy.

10. Backup and retention

Microsoft mirrors SharePoint and OneDrive data across at least two datacentres, but recovering deleted or encrypted files is partly your job. Built-in tools include the recycle bin, version history and OneDrive Files Restore, which rolls back to any point in the past 30 days.

Retention policies serve a different purpose. They decide what to keep or delete for compliance, and Microsoft describes them as a data lifecycle tool. Find them in the Microsoft Purview portal under Solutions > Data Lifecycle Management.

For longer recovery, Microsoft 365 Backup covers OneDrive, SharePoint and Exchange Online as a pay-as-you-go service. Ask your IT supplier what you could restore, and how far back.

Where Cyber Essentials fits

Cyber Essentials is the UK cyber security certification scheme. Its current requirements, version 3.3, took effect on 27 April 2026.

Items 1 and 2 map straight onto it. The requirements say authentication to cloud services must always use MFA where available, and administrators need separate accounts. IASME says missing MFA on a cloud service that offers it is an automatic fail, whether MFA is free, included or paid. The NCSC names Microsoft 365 as an example of a cloud service.

Backup is not a technical requirement of Cyber Essentials, though the NCSC highly recommends it. The scheme also covers your devices, so treat this list as a head start rather than a pass.

How cloud365.io can help

Our Microsoft 365 audit reviews sign-in and MFA, admin roles, external sharing, email security, devices, and audit logging and retention. You get a written report, mapped to Cyber Essentials where it applies. It needs read-only admin access, and you can email us to ask for one.