Microsoft 365 Security Basics Every Small Business Should Turn On

Most small-business security incidents start in email: a stolen password, a convincing fake invoice, or a mailbox rule that quietly forwards everything to someone outside the company. Microsoft 365 has the tools to stop most of that, but several of them depend on your licence and on settings someone has to check. This is the short list we work through on every small-business tenant.

Menu names and licence bundles change often. Treat this as a checklist of what to look for, and confirm each item in your own admin centers.

1. Multi-factor authentication for everyone

MFA is the single most effective setting on this list. A stolen password alone is no longer enough to get into the account.

• If you don't have Microsoft Entra ID P1 (included in Microsoft 365 Business Premium), turn on security defaults. They require MFA registration for all users and block older sign-in methods that can't do MFA.
• If you do have P1, use Conditional Access policies instead, so you can require MFA everywhere and make exceptions deliberately rather than by accident.
• Prefer an authenticator app over text messages where you can.
• Check for accounts that have never registered for MFA, especially shared mailboxes someone can sign in to and old accounts nobody uses.

2. Separate, protected admin accounts

• Give the people who administer the tenant a separate admin account, used only for admin work. Their everyday account, the one that reads email and opens attachments, should not be a Global Administrator.
• Keep the number of Global Administrators small: two or three, not everyone who once needed to reset a password.
• Make sure the admin accounts belong to the company, use company email addresses, and are documented somewhere the business controls. If the only admin is a former employee or an outside contractor, fix that first.
• Keep one emergency ("break-glass") admin account with a long password stored securely, for the day MFA or the usual admin isn't available.

3. Make your domain hard to impersonate

Three DNS records tell other mail systems which servers may send email as your domain. Without them, anyone can send convincing email that appears to come from you.

• SPF lists the services allowed to send as your domain: Microsoft 365, plus your newsletter tool, invoicing system or anything else that sends on your behalf.
• DKIM signs outgoing mail. Turn it on for your domain in the Microsoft 365 Defender portal and publish the records it gives you.
• DMARC tells receivers what to do with mail that fails those checks. Start by monitoring, fix any legitimate senders that fail, then move to quarantine or reject.

4. Stop mail leaving without anyone noticing

• Check the outbound spam policy so mailboxes can't automatically forward mail to outside addresses unless you've approved it.
• Review existing inbox rules and forwarding on every mailbox. A rule that forwards or deletes invoices is a classic sign of a compromised account.
• Make sure the audit log is on, so you can find out what happened if an account is ever misused.

5. Phishing and malware protection

• Exchange Online Protection is included with every mailbox. Review its anti-phishing settings, including impersonation protection for your senior staff and your own domain.
• If your plan includes Microsoft Defender for Office 365 (Business Premium does), turn on Safe Links and Safe Attachments.
• Show staff how to report a suspicious message, and make sure someone actually looks at the reports.

6. Sharing in OneDrive, SharePoint and Teams

• Decide who may share files with people outside the company, and whether "anyone with the link" sharing should be allowed at all.
• Set links to expire, and default new links to "people in your organization".
• Review guest access in Teams, and remove guests who no longer need it.

7. Devices and leavers

• If you have Intune (included in Business Premium), require company devices to be encrypted, patched and protected before they can open company data.
• When someone leaves, block sign-in and revoke sessions the same day, then deal with their mailbox and files. Don't wait for the licence renewal.

8. Back up Microsoft 365

Microsoft keeps the service running, but its retention features are not a full backup. If a user deletes a folder, a compromised account wipes a mailbox, or ransomware encrypts files in OneDrive, you want a separate copy you control, with a retention period you chose. Test a restore once in a while, so you know it works.

Where to start

If you only have an hour, do the first two: MFA for every account, and separate admin accounts that belong to the company. Those two settings close the doors most attackers use. Then work down the list over the next few weeks.