Microsoft 365 Security Checklist for Small Businesses: 10 Settings to Check

Most small businesses I talk to are already paying for Microsoft 365. Email, Teams, OneDrive, SharePoint: it’s the backbone of how they work. But when I ask, “Who set up the security?”, the answer is usually a shrug. Someone created the account, added the users, and everyone got back to work.

That’s understandable. You’re running a business, not an IT department. The good news is that Microsoft 365 comes with strong security tools built in. Most of them are just switched off, or never configured. In more than 20 years working in corporate IT and cybersecurity, I’ve seen the same handful of gaps behind most account takeovers, phishing losses and “we can’t find that file” emergencies.

This checklist covers the ten settings I check first for any small business. You don’t need to be technical to understand them. You do need someone with admin access to work through them.

1. Turn on multi-factor authentication for everyone

If you do only one thing on this list, do this. Multi-factor authentication (MFA) means a stolen password alone isn’t enough to get into an account. The person also needs a code or approval from the user’s phone.

For most small businesses, the simplest route is to turn on Security Defaults in Microsoft Entra ID (formerly Azure AD). It requires MFA for all users and blocks older sign-in methods that attackers love. If you’re on Microsoft 365 Business Premium, you can use Conditional Access instead for more control.

Yes, staff will grumble for a week. Then it becomes routine, like locking the office door.

2. Separate your admin accounts

The account you use to read email every day should not be a Global Administrator. If that everyday account gets phished, the attacker gets the keys to your whole tenant.

• Create a separate admin account used only for administration.
• Keep the number of Global Administrators small: two is usually right, so you’re never locked out if one person is unavailable.
• Protect admin accounts with the strongest MFA method available, such as the Microsoft Authenticator app or a security key.

3. Block legacy authentication

Older email apps and protocols can sign in with just a username and password, skipping MFA entirely. Security Defaults blocks them for you. If you use Conditional Access instead, make sure you have a policy that blocks legacy authentication. Otherwise MFA has a back door.

4. Strengthen email protection against phishing

Email is still the number one way attackers get in. Check that anti-phishing, anti-spam and anti-malware policies are turned on and set to sensible levels. If you have Business Premium, you also have Microsoft Defender for Office 365, which adds Safe Links and Safe Attachments. Turn them on.

Ask your domain provider (or your IT person) to confirm your SPF, DKIM and DMARC records are set up. They make it much harder for someone to send email pretending to be you, and they help your own messages land in inboxes instead of spam.

5. Review external sharing in SharePoint and OneDrive

“Anyone with the link” sharing is convenient, and it’s also how client files end up in places they shouldn’t be. In the SharePoint admin centre, review your sharing settings. For most businesses I recommend:

• Sharing limited to people who sign in or verify with a code, not anonymous links.
• Links that expire after a set number of days.
• A quick quarterly review of what has been shared outside the company.

6. Make sure audit logging is on

If something goes wrong, the audit log tells you who signed in, from where, and what they did. Without it, you’re guessing. Check in the Microsoft Purview portal that auditing is turned on. It takes two minutes and you’ll be very glad it’s there on a bad day.

7. Don’t confuse Microsoft 365 with a backup

This one surprises people. Microsoft keeps the service running, but it isn’t responsible for protecting you from your own mistakes, a disgruntled employee, or ransomware that encrypts your synced files. Deleted items are only kept for a limited time.

Set up retention policies for important mailboxes and sites, and consider a dedicated Microsoft 365 backup service. Then test a restore. A backup you’ve never restored from is a hope, not a plan.

8. Manage the devices that access your data

Your data is only as safe as the laptops and phones it lives on. With Business Premium you have Microsoft Intune, which lets you require device encryption, screen locks and up-to-date software, and wipe company data from a lost phone. Even if you’re not ready for full device management, at least require a PIN and updates on any device that gets company email.

9. Train your team (briefly and often)

Technology stops most attacks. People stop the rest. You don’t need a long annual course. A short conversation every few months about what phishing looks like right now, plus a clear way to report a suspicious email, goes a long way. Make it safe for staff to say “I think I clicked something.” The faster you know, the smaller the damage.

10. Check your Secure Score every month

Microsoft Secure Score, in the Microsoft Defender portal, gives you a percentage and a prioritized list of improvements specific to your tenant. Treat it as your to-do list. You don’t need to hit 100%; you need to keep moving in the right direction and understand why you’ve chosen to skip anything you skip.

A Canadian resource worth bookmarking

The Canadian Centre for Cyber Security publishes free guidance written for organizations like yours, including its Baseline Cyber Security Controls for Small and Medium Organizations. If you ever experience a cyber incident or fraud, report it to the Cyber Centre and the Canadian Anti-Fraud Centre, and contact your insurer if you have cyber coverage.

Where to start

If this list feels like a lot, start with numbers 1, 2 and 7: MFA for everyone, separate admin accounts, and a real backup. Those three alone close the doors I see attackers walk through most often.

If you want to learn to do this work properly, the Microsoft Premium Training covers Entra ID, Conditional Access, Defender and Exchange Online security hands-on, in live Saturday sessions.

See the Microsoft training, or train your IT team.

— Okowil Solutions Inc.