Microsoft 365 security checklist for small businesses: 7 settings most companies miss
Almost every small business runs on Microsoft 365, and almost every one of them still has it configured the way it came out of the box. The defaults are built to work for everyone, not to protect you specifically.
Here are the seven settings we find missing most often in our audits, ranked by impact.
1. Multi-factor authentication for everyone
This is the big one. Most business email compromise starts with a leaked or guessed password. With MFA, a password alone isn’t enough.
If your licenses don’t include advanced features, turn on Microsoft Entra security defaults, which require MFA for every user at no extra cost. If you’re on Microsoft 365 Business Premium, use Conditional Access for finer-grained rules.
2. Separate admin accounts
Whoever administers your tenant shouldn’t use the same account to read email and browse the web. Create dedicated admin accounts with strong MFA and only use them when needed. A bad click on a regular account is an incident. On an admin account, it’s the whole company.
3. External sharing under control
By default, it’s easy to share OneDrive and SharePoint files with “anyone with the link.” That’s a data leak waiting to happen. Limit external sharing to specific people and set expiration dates on guest links.
4. An offboarding checklist
When someone leaves, their access should leave the same day: block sign-in, revoke active sessions, forward or convert the mailbox, and hand their OneDrive files to a manager. Without a checklist, this gets done halfway, and former employees with live access are one of the most common risks we find.
5. Real backups of your Microsoft 365 data
Many people assume “Microsoft backs it up.” Microsoft keeps the service running, but items deleted by mistake, by a disgruntled user or by synced ransomware may be unrecoverable once retention windows pass. Keep an independent copy, and test restoring from it.
6. Alerts someone actually reads
Microsoft 365 can flag suspicious sign-ins, new forwarding rules sending mail outside the company and mass file deletions. Those alerts only help if they reach someone who looks at them and knows what to do.
7. Protection against malicious links and attachments
Phishing is still the number one way in. Microsoft Defender’s email protection checks links at click time and attachments before they hit the inbox. If your license includes it, make sure it’s on and configured.
Where to start
If you only do one thing this week, do number one. MFA for everyone removes most of the risk on its own.
If you want to know exactly where your setup stands, our technical audit reviews your Microsoft 365, backups and access, and hands you the risks in priority order.