Microsoft 365 comes with more protection than most small businesses use. Several of the most useful settings are free with every plan, and some are switched off by default. This is the checklist we work through when we take over a Microsoft 365 account for a business in the Fraser Valley or Metro Vancouver. Most items take minutes. A few need planning so nobody gets locked out.
We have grouped the settings by the problem they solve, because in practice they work together. A short summary you can tick off sits at the end.
Start with how people sign in
Most break-ins to a small business mailbox still start with a stolen password, which is why asking for more than a password matters more than any other setting on this list. How you require it depends on your plan. Business Basic and Business Standard rely on security defaults, a single switch that makes everyone register for multi-factor sign-in and shuts off the legacy sign-in methods that cannot use it. Business Premium includes Conditional Access, where you write your own rules: stricter sign-in for administrators, for example, or access to company data only from managed devices. Policies that react to risky sign-ins or risky users are a separate feature. They need Microsoft Entra ID P2, which is not part of Business Premium, so budget for it if you want them. Microsoft already insists on multi-factor sign-in for its admin portals, and your staff accounts deserve the same protection.
Administrator access needs its own rules. If the account someone uses for email and web browsing is also a global administrator, one bad link can hand an attacker control of the whole tenant, so keep administrative work in a separate account that does nothing else, and keep the number of global administrators below five, as Microsoft advises. Then plan for a lockout. Microsoft recommends at least two cloud-only emergency access accounts (not synced from an office server) that do not belong to any one person, each protected with phishing-resistant sign-in such as a passkey on a security key, kept apart from your day-to-day admin sign-in. Store their credentials securely, set an alert for every time they are used, and test that they still work at least every 90 days.
Make sure you can see what happened
After an incident, the audit log is the record of which accounts signed in, which settings changed and many of the actions taken in email and files. Without it, investigating a break-in is mostly guesswork. Microsoft's documentation states that auditing is not enabled by default on its small and medium business licences, including Business Basic, Business Standard and Business Premium, so open the Microsoft Purview portal and switch it on. From then on, supported activity is kept for 180 days. What gets recorded depends on your licence, though. A record of exactly which emails someone opened is not guaranteed on every plan, so check what your logs actually capture before you need them, and never treat a missing entry as proof that a message was left untouched.
Close the doors attackers use inside a mailbox
A hijacked mailbox stays useful to a criminal for as long as they can keep reading it. A favourite trick is a hidden inbox rule that sends copies of incoming mail to an address outside the business, which keeps working even after the password is reset. Microsoft Defender controls whether mail can be forwarded automatically outside your organization, through the outbound spam policy. Set that option to Off, so the block is written into your own policy instead of resting on a default. Where someone has a real business reason to forward mail, make an exception for that one mailbox and record why.
The second door is app consent. By default, staff may be able to click "Accept" on an app that asks to read their mailbox or files, and some phishing attacks rely on exactly that. In Microsoft Entra ID, limit user consent to apps from verified publishers that ask for low-risk permissions, or require admin approval for all new apps.
Make fake email harder to send and easier to spot
DKIM adds a digital signature to every message you send, and DMARC tells other mail servers what to do with messages that claim to be from you but are not. Together they make it much harder for someone to send fake invoices that look like yours, and they help your real mail land in inboxes. DKIM signing is switched on per domain in Microsoft Defender. The DMARC record lives in your domain's DNS, and the safe way to begin is with a policy of p=none, which only reports, tightening it once the reports show that every legitimate sender passes.
On the receiving side, two small changes help staff catch what gets through. The first is an "External" label that Outlook adds to messages from outside your organization, so an email pretending to come from a colleague or the owner stands out at a glance. An administrator switches it on once, through Exchange Online PowerShell. The second is Microsoft's preset security policies, which apply its recommended anti-spam, anti-malware and anti-phishing settings in one step. Apply the Standard preset to everyone. On Business Premium, the same presets also cover Safe Links and Safe Attachments, which check links and files when they are opened.
Decide how files are shared
Decide whether staff can share SharePoint and OneDrive files with people outside the business, and how. For most small businesses, sharing with specific named people is enough. If you allow "anyone with the link" sharing, set those links to expire. Make "people in your organization" the default link type so a quick share does not go further than intended.
Which plan includes what?
Most of what is above works on every Microsoft 365 business plan: security defaults, audit logging, forwarding controls, DKIM, the External label, the preset anti-spam and anti-malware policies, app consent settings and sharing settings. Business Premium adds Conditional Access, device management with Intune, Defender for Business on computers, and Safe Links and Safe Attachments. Whichever plan you have, the settings already included in it are the place to start.
Track your progress
Microsoft Secure Score, in the Defender portal, lists recommended settings for your account and shows which ones are done. It is a useful to-do list, but not every recommendation fits every business, so treat it as a guide rather than a target.
The checklist at a glance
- More than a password required of every user, through security defaults or Conditional Access
- Admin work done from separate admin accounts, with fewer than five global administrators
- At least two cloud-only emergency access accounts with phishing-resistant sign-in, monitored and tested
- Audit logging turned on
- External auto-forwarding blocked in the outbound spam policy, with named exceptions only
- User consent to apps limited, or admin approval required
- Outgoing mail signed with DKIM, and a DMARC policy published for your domain
- The External label on email from outside the business
- The Standard preset security policy applied to everyone
- Sharing rules set for SharePoint and OneDrive
How we help
Bitlogix reviews and secures Microsoft 365 for small businesses in Mission, Abbotsford, Chilliwack, Langley and across the Lower Mainland, with remote support anywhere in BC. We plan each change so nobody is locked out, and afterwards you receive a written record of every change and the reason for it. Our free IT assessment includes a look at your Microsoft 365 or Google Workspace settings. If you would rather talk it through first, book a free 30-minute consultation and we will go over your setup with you.
Useful references
- Security defaults in Microsoft Entra ID, Microsoft Learn
- Microsoft Entra ID Protection risk-based access policies, Microsoft Learn
- Manage emergency access admin accounts, Microsoft Learn
- Turn auditing on or off, Microsoft Learn
- Controlling automatic external email forwarding, Microsoft Learn
- Set up DKIM, Microsoft Learn
- Preset security policies, Microsoft Learn
- Configure how users consent to applications, Microsoft Learn
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security