Microsoft 365 comes with more protection than most small businesses use. Several of the most useful settings are included in every business plan, and some of them are switched off by default. This is the checklist we work through when we take over a Microsoft 365 account for a US small business. Most items take minutes. A few need planning so nobody gets locked out.
We have grouped the settings by the problem they solve, because in practice they work together. A short summary you can check off sits at the end.
Start with how people sign in
Most break-ins to a small business mailbox still start with a stolen password, which is why asking for more than a password matters more than any other setting on this list. How you require it depends on your plan. Business Basic and Business Standard rely on security defaults, a single switch that makes everyone register for multi-factor sign-in and shuts off the legacy sign-in methods that cannot use it. Business Premium includes Conditional Access, where you write your own rules: stricter sign-in for administrators, for example, or access to company data only from managed devices. Policies that react to risky sign-ins or risky users are a separate feature. They need Microsoft Entra ID P2, which is not part of Business Premium, so budget for it if you want them. Microsoft already insists on multi-factor sign-in for its admin portals, and your staff accounts deserve the same protection. Our guide to passwords, password managers and passkeys covers which sign-in methods to prefer.
Administrator access needs its own rules. If the account someone uses for email and web browsing is also a global administrator, one bad link can hand an attacker control of the whole tenant, so keep administrative work in a separate account that does nothing else, and keep the number of global administrators below five, as Microsoft advises. Then plan for a lockout. Microsoft recommends at least two cloud-only emergency access accounts (not synced from an office server) that do not belong to any one person, each protected with phishing-resistant sign-in such as a passkey on a security key, kept apart from your day-to-day admin sign-in. Store their credentials securely, set an alert for every time they are used, and test that they still work at least every 90 days.
Make sure you can see what happened
After an incident, the audit log is the record of which accounts signed in, which settings changed and many of the actions taken in email and files. Without it, investigating a break-in is mostly guesswork. Microsoft's documentation states that auditing is not enabled by default on its small and medium business licenses, including Business Basic, Business Standard and Business Premium, so open the Microsoft Purview portal and switch it on. From then on, supported activity is kept for 180 days. What gets recorded depends on your license, though. A record of exactly which emails someone opened is not guaranteed on every plan, so check what your logs actually capture before you need them, and never treat a missing entry as proof that a message was left untouched.
Close the doors attackers use inside a mailbox
A hijacked mailbox stays useful to a criminal for as long as they can keep reading it. A favorite trick is a hidden inbox rule that sends copies of incoming mail to an address outside the business, which keeps working even after the password is reset. Microsoft Defender controls whether mail can be forwarded automatically outside your organization, through the outbound spam policy. Set that option to Off, so the block is written into your own policy instead of resting on a default. Where someone has a real business reason to forward mail, make an exception for that one mailbox and record why.
The second door is app consent. By default, staff may be able to click "Accept" on an app that asks to read their mailbox or files, and some phishing attacks depend on exactly that. In Microsoft Entra ID, limit user consent to apps from verified publishers that ask for low-risk permissions, or require admin approval for every new app.
Make fake email harder to send and easier to spot
DKIM adds a digital signature to every message you send, and DMARC tells other mail servers what to do with messages that claim to come from you but do not. Together they make fake invoices in your name much harder to pull off, and they help your real mail reach inboxes. DKIM signing is switched on per domain in Microsoft Defender. The DMARC record lives in your domain's DNS, and the safe way to begin is with a policy of p=none, which only reports, tightening it once the reports show that every legitimate sender passes. Our plain-English guide to SPF, DKIM and DMARC walks through each record.
On the receiving side, two small changes help staff catch what gets through. The first is an "External" label that Outlook adds to messages from outside your organization, so an email pretending to come from a colleague or the owner stands out at a glance. An administrator switches it on once, through Exchange Online PowerShell. The second is Microsoft's preset security policies, which apply its recommended anti-spam, anti-malware and anti-phishing settings in one step, so you are not tuning dozens of options by hand. Apply the Standard preset to everyone. On Business Premium, the same presets also turn on Safe Links and Safe Attachments, which check links and files at the moment they are opened.
Decide how files are shared
Decide whether staff can share SharePoint and OneDrive files with people outside the business, and how. For most small businesses, sharing with specific named people is enough. If you allow "anyone with the link" sharing, make those links expire, and set "people in your organization" as the default link type so a quick share does not travel further than intended.
If HIPAA or the FTC Safeguards Rule applies to you
Several of these settings line up with what US rules expect. The FTC Safeguards Rule requires multi-factor authentication for anyone who accesses customer information and asks covered businesses to monitor and log user activity. The HIPAA Security Rule requires audit controls that record activity in systems holding electronic patient information. Turning these settings on is a strong start, but it is not a complete compliance program on its own. Our FTC Safeguards Rule guide explains who the rule covers.
Which plan includes what?
Most of what is above works on every Microsoft 365 business plan: security defaults, audit logging, forwarding controls, DKIM, the External label, the preset anti-spam and anti-malware policies, app consent settings and sharing settings. Business Premium adds Conditional Access, device management with Intune, Defender for Business on computers, and Safe Links and Safe Attachments. Whichever plan you have, the settings already included in it are the place to start.
Track your progress
Microsoft Secure Score, in the Defender portal, lists recommended settings for your account and shows which ones are done. It makes a useful to-do list, but not every recommendation fits every business, so treat it as a guide rather than a target. For a second opinion, CISA publishes secure configuration baselines for Microsoft 365 through its SCuBA project. They were written for federal agencies and go further than most small businesses need, but they are worth a read.
The checklist at a glance
- More than a password required of every user, through security defaults or Conditional Access
- Admin work done from separate admin accounts, with fewer than five global administrators
- At least two cloud-only emergency access accounts with phishing-resistant sign-in, monitored and tested
- Audit logging turned on
- External auto-forwarding blocked in the outbound spam policy, with named exceptions only
- User consent to apps limited, or admin approval required
- Outgoing mail signed with DKIM, and a DMARC policy published for your domain
- The External label on email from outside the business
- The Standard preset security policy applied to everyone
- Sharing rules set for SharePoint and OneDrive
This article is general information, not legal advice. Confirm your obligations with your attorney or compliance advisor.
How we help
Bitnode Technologies reviews and secures Microsoft 365 for US small businesses, with remote support nationwide and on-site visits by arrangement. We plan each change so nobody is locked out, and afterwards you receive a written record of every change and the reason for it. Our free IT assessment includes a look at your Microsoft 365 or Google Workspace settings. If you would rather talk it through first, book a free 30-minute consultation and we will go over your setup with you.
Useful references
- Security defaults in Microsoft Entra ID, Microsoft Learn
- Microsoft Entra ID Protection risk-based access policies, Microsoft Learn
- Manage emergency access admin accounts, Microsoft Learn
- Turn auditing on or off, Microsoft Learn
- Controlling automatic external email forwarding, Microsoft Learn
- Set up DKIM, Microsoft Learn
- Preset security policies, Microsoft Learn
- Configure how users consent to applications, Microsoft Learn
- Secure Cloud Business Applications (SCuBA) Project, CISA
- Small Business Cybersecurity Corner, NIST