How do I make sure Microsoft 365 is secure?

Turn on multi-factor authentication for everyone, lock down your admin accounts, block the old sign-in methods that get around MFA, set up email authentication, switch on Microsoft’s anti-phishing protection, and only let managed devices in. Then use Microsoft Secure Score to check your work, and look at it again every month or so.

Most small businesses I look at have done one or two of those six.

Microsoft 365 is sold as a way to get people working on day one, and it’s set up for exactly that. Most of the security tools are already in the licence you pay for. They’re just switched off, and nobody mentions that switching them on is your job.

Below is the list I work through for a business of ten to fifty people. It’s for whoever holds the Microsoft 365 admin login, which is usually the owner, the office manager, or the IT person who comes in two days a week.

What Microsoft does, and what’s left to you

Microsoft calls this the shared responsibility model. It looks after the data centres, servers, network and software. How your own tenant is set up is down to you: who can sign in, from where and on what device, what they can share, and what email gets through.

The small business breaches I see come from that second half. A stolen password on an account without MFA, a forwarding rule nobody noticed, a shared link that ended up public.

First, check which licence you have

What you can switch on depends on your plan. In the Microsoft 365 admin centre, go to Billing > Your products.

	Business Basic / Standard	Business Premium
MFA	Yes, through Security Defaults	Yes, through Conditional Access
Conditional Access (rules about who, where, which device)	No	Yes
Intune device management	No	Yes
Defender for Business (laptop protection)	No	Yes
Safe Links and Safe Attachments	No	Yes

You can secure a Basic or Standard tenant reasonably well with Security Defaults and the email settings below. If you handle client money, personal data or anything confidential, Business Premium is usually worth the extra few pounds per user a month, because it unlocks most of this list.

The Microsoft 365 security checklist

1. Turn on MFA for every account

If you only do one thing on this list, do this. Microsoft’s own figures say MFA blocks over 99% of automated attacks on accounts.

• Business Basic or Standard: make sure Security Defaults is on (Entra admin centre > Overview > Properties > Manage security defaults). It requires everyone to register for MFA and blocks legacy sign-in.
• Business Premium: turn Security Defaults off and replace it with Conditional Access policies, which let you require MFA for everyone while handling exceptions properly.

Use the Microsoft Authenticator app rather than text messages where you can. Microsoft now forces MFA on its admin portals, but not on your staff signing in to Outlook, so you still need to turn it on for them.

2. Lock down your admin accounts

A global administrator account can change anything in the tenant, so it’s the first thing an attacker goes looking for.

• Keep global admins to two to four people.
• Give admins a separate admin account that they don’t use for day-to-day email.
• Use the least powerful role that does the job - a “User administrator” or “Exchange administrator” rather than global admin.
• Set up one emergency “break-glass” account, with a long password stored safely offline, so you can’t lock yourself out.
• Require phishing-resistant MFA (a security key or passkey) for admin accounts if you’re on Business Premium.

3. Block legacy sign-in

Older sign-in methods - the kind used by old versions of Outlook, some phone mail apps, and scanners that email you documents - can’t do MFA. While they’re allowed, anyone with a password can sign in without being asked for MFA.

Security Defaults blocks them. On Business Premium, add a Conditional Access policy to block legacy authentication. Check the sign-in logs first for anything still using it (usually a scanner or a line-of-business app) and sort that out before you switch it off.

4. Set up email authentication: SPF, DKIM and DMARC

These three DNS records stop people sending email that pretends to come from your domain. Invoice and payment-redirection fraud usually starts with exactly that kind of email.

• SPF lists the services allowed to send email for your domain.
• DKIM signs your outgoing email so it can’t be altered in transit. Turn it on in the Defender portal under Email authentication settings.
• DMARC tells other mail servers what to do with email that fails those checks. Start with p=none to monitor, then move to p=quarantine and finally p=reject once you’re sure all your legitimate email passes.

Google, Yahoo and Microsoft now expect all three, so setting them up also helps your own email stay out of people’s spam folders.

5. Switch on Microsoft’s anti-phishing protection

Exchange Online Protection is included in every plan. If you have Business Premium, you also get Defender for Office 365, which adds Safe Links (checks links when they’re clicked) and Safe Attachments (opens attachments in a sandbox before they reach anyone).

The quickest way to turn this on is Microsoft’s preset security policies - Standard or Strict - in the Defender portal under Email & collaboration > Policies & rules > Threat policies. Standard suits most small businesses. It takes a few clicks and turns on impersonation protection, spoof protection and sensible spam settings.

6. Only let managed devices in

MFA confirms the right person is signing in. It tells you nothing about the laptop they’re signing in from.

On Business Premium, enrol company laptops and phones in Intune, set a baseline (encryption on, screen lock, updates installed, Defender running), and add a Conditional Access policy that only lets compliant devices reach company data. For personal phones, use app protection policies so work data stays inside Outlook and Teams and can be wiped without touching anyone’s photos.

7. Stop users approving dodgy apps

Some attacks skip the password entirely. Someone is tricked into clicking “Accept” on a third-party app that asks for access to their mailbox, and that access carries on working after a password reset.

In the Entra admin centre, under Enterprise applications > Consent and permissions, restrict users to approving apps from verified publishers only, or turn on admin consent requests so you approve new apps yourself.

8. Check external sharing and forwarding

• Mail forwarding: make sure automatic forwarding to external addresses is blocked (it’s off by default in the outbound spam policy - check nobody has turned it back on). Then look for existing forwarding rules on mailboxes. A rule quietly copying someone’s email to a Gmail address is one of the most common signs that an account has been taken over.
• SharePoint and OneDrive: in the SharePoint admin centre, change the default sharing link from “Anyone” to “People in your organisation” or “Specific people”, and set an expiry on any “Anyone” links you do allow.

9. Back up your data properly

Microsoft’s recycle bins and retention settings will get back a deleted file or two. They won’t reliably get back a whole mailbox or SharePoint site that someone has deleted or encrypted.

Use Microsoft 365 Backup or a reputable third-party backup for Exchange, OneDrive and SharePoint, and test a restore at least once.

10. Train your people, then make it easy to report things

Most attacks still start with an email. Short, regular phishing reminders work better than an hour-long course once a year. Turn on the built-in Report button in Outlook so staff can flag suspicious messages in one click, and make sure someone actually looks at what gets reported.

How to check your work: Microsoft Secure Score

Once you’ve worked through the list, open Secure Score in the Microsoft Defender portal. It gives your tenant a percentage and a ranked list of improvement actions, with links straight to the right setting.

Don’t treat the number as a pass mark. A small business can sit at 60% and be in good shape, or at 75% with a big gap. Some actions matter far more than their points suggest (MFA and blocking legacy sign-in especially), and some don’t suit a small business at all. Work down the list, and look at it again every month, because Microsoft keeps adding recommendations.

How long does this take?

For someone who knows their way around the admin centres, the core of this list is a few days’ work for a small business, plus a week or two of rolling changes out gently so nobody is locked out on a Monday morning. The time-consuming parts are the ones involving people: getting everyone registered for MFA, enrolling laptops, and finding out which old scanner breaks when legacy sign-in goes off. That rollout is most of what our fixed-price Microsoft 365 uplift covers.

After that it needs someone to keep an eye on it. People join and leave, Microsoft changes its defaults, and settings get switched back for convenience.

If a customer has started asking about Cyber Essentials, this list covers a good part of it: secure configuration, user access control and malware protection.

If you’re doing it yourself, the NCSC’s guidance on using cloud services securely and its Small Business Guide are both worth bookmarking.