Microsoft 365 security checklist for small business

Microsoft 365 runs email, files and sign-ins for a lot of small businesses, and several of its protective settings are off or left at a default you may not want. You can change all of them yourself. A couple of steps use a single PowerShell command, and we say so where they come up.

You'll need a Global Administrator account and the login for wherever your domain's DNS is managed. Microsoft renames menus from time to time, so if a label below doesn't match your screen, search the admin center for the setting's name.

How do I turn on MFA for everyone in Microsoft 365?

Multifactor authentication (MFA) means a stolen password alone won't open an account. Microsoft offers two ways to require it, and your plan decides which one you can use.

Security defaults are free in every Microsoft 365 organization. They're a single switch that makes everyone register for MFA, asks admins for it every time they sign in, and blocks older sign-in methods. Microsoft has been switching them on for new tenants since October 2019, so yours may already be on.

Conditional Access lets you write your own rules about who needs MFA and when. It needs Microsoft Entra ID P1, and Microsoft lists Business Premium among the plans that include it. You can't run both at once: security defaults have to be off before any Conditional Access policy can be switched on.

For most teams of 1 to 50 people, security defaults are enough. To check or turn them on:

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) with an admin account.
2. Go to Entra ID → Overview → Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled and select Save.

Tell your team before you flip the switch. Each person sets up an authenticator app, usually Microsoft Authenticator, the next time they sign in, or ahead of time at myprofile.microsoft.com under Security info.

If you're on Business Premium and prefer Conditional Access, start from Microsoft's templates under Conditional Access → Policies → New policy from template. Microsoft says four of them recreate security defaults: require MFA for all users, require MFA for administrators, block legacy authentication, and require MFA for Azure management. Set those up before anything custom.

Today, open the Properties page and confirm that either security defaults or Conditional Access is protecting your accounts.

How should I set up admin roles?

Whoever bought your subscription is a Global Administrator by default, and that role can change almost any setting and see most of your data. Microsoft advises keeping that group small and giving everyone else the narrowest role that covers their job.

• Keep Global Administrator to one or two trusted people. If one gets locked out, another Global Administrator or a Privileged Authentication Administrator can reset their password.
• Give helpers a smaller role. Someone who only resets passwords needs Password Administrator or Helpdesk Administrator.
• Use a separate account for admin work, such as admin-maria@yourbusiness.com next to maria@yourbusiness.com, and read everyday email with the regular one. Microsoft recommends this in its security defaults guidance.
• Review the list whenever someone leaves or changes jobs.

To see who holds each role, open the Microsoft 365 admin center (admin.microsoft.com), go to Roles → Role assignments, select a role, and look at the Assigned tab. To change one person's access, go to Users → Active users, select them, and choose Manage roles.

This week, remove Global Administrator from anyone who doesn't need it day to day.

How do I block legacy sign-ins?

Older mail protocols such as IMAP, POP3 and SMTP, and older Office apps such as Office 2010, use what Microsoft calls legacy authentication. It doesn't support MFA, so someone with a stolen password can use it to get past your MFA requirement.

97%

If security defaults are on, legacy authentication is already blocked. With Conditional Access, use the Block legacy authentication template. Microsoft suggests creating it in Report-only mode first, so you can see who it would affect before you set it to On.

Before you block it, find out what still relies on it. In a small office, that's often a scanner or copier that emails scans, or someone on a very old copy of Office. In the Entra admin center, go to Entra ID → Monitoring & health → Sign-in logs, add the Client App column, and filter for the legacy protocols. Check the non-interactive sign-ins tab too.

If anything turns up, update or reconfigure it first, then turn on the block.

How do I set up SPF, DKIM and DMARC for my domain?

These three DNS records let other email providers check that a message claiming to be from yourbusiness.com came from you. SPF lists your approved senders, DKIM adds a signature, and DMARC tells receivers what to do with messages that fail. Microsoft signs mail from your onmicrosoft.com address automatically, but it says no DKIM signing happens for a custom domain until you set it up.

SPF

Microsoft 365 has no SPF setting; the record lives at your DNS host. If Microsoft 365 is the only service that sends as your domain, Microsoft recommends the record above, ending in -all. If a newsletter tool or online store also sends as you, add its include: value to the same record. Keep one SPF record per domain and stay under SPF's 10-lookup limit. Our guide to SPF too many DNS lookups explains what to do if you go over.

DKIM

1. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, then open the DKIM tab.
2. Select your domain and copy the two CNAME values Microsoft shows.
3. Add both CNAME records at your DNS host.
4. Once Microsoft detects them, turn on Sign messages for this domain with DKIM signatures.

The Microsoft 365 DKIM setup guide walks through each screen, including the error message Microsoft shows on the way.

DMARC

Add the DMARC record at your DNS host once SPF and DKIM are working. Start with p=none so nothing is blocked while you read the reports, then move to p=quarantine and later p=reject. Microsoft recommends the same gradual order, and how to read DMARC reports explains what to look for before each step.

Check your Microsoft 365 domain from the outside

Our free checkup looks at SPF, DMARC, DKIM on common selectors (including selector1 and selector2) and your website basics, then explains what to fix.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I label email from outside the company?

Business email compromise often starts with a message that looks like it came from a coworker or the owner. An External label on outside mail gives your team a cue that "the owner" is writing from an address outside your domain.

Outlook can add an External label near the subject line on Windows, Mac, the web, iPhone and Android. You turn it on with one command in Exchange Online PowerShell:

Set-ExternalInOutlook -Enabled $true

Microsoft says it can take 24 to 48 hours for the label to appear. If you already have a mail flow rule that adds text like "External" to subject lines, turn that rule off first so messages aren't tagged twice.

Once it's on, tell your team what the label means. Ask them to call the person directly before acting on any payment or password request from an External sender.

Which Defender for Office 365 settings should I use?

Every Microsoft 365 plan with mailboxes includes built-in spam, malware and spoofing protection. Business Premium also includes Defender for Office 365 Plan 1, which Microsoft says protects against zero-day malware, phishing and business email compromise. It adds Safe Links, Safe Attachments and protection against people impersonating your staff or domain. On other plans, you can buy it as an add-on.

The simplest way to use these protections is a preset security policy. A preset applies Microsoft's recommended settings in one go, and most of them can't be changed, which suits a team without an IT department. Standard fits most businesses. Strict is tighter: mail identified as spam goes to quarantine instead of the Junk Email folder, for example.

1. In the Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Preset Security Policies.
2. Turn on Standard protection, then select Manage protection settings.
3. Choose All recipients so everyone is covered.
4. If you have Defender for Office 365, add the people most likely to be impersonated, such as the owner and whoever approves payments, on the impersonation page.
5. Review the summary and select Confirm.

On Business Basic or Business Standard, the wizard skips the Defender pages, and the Standard preset still applies Microsoft's recommended spam, malware and phishing settings. Turn it on today.

How do I spot a mailbox that's been taken over?

Microsoft's warning signs for a compromised mailbox include inbox rules that forward email to unknown addresses, rules that move messages into the Notes, Junk Email or RSS Subscriptions folders, and recently added external forwarding. Two settings help you catch these early and work out what happened.

Turn on the audit log

The audit log records user and admin activity. Microsoft says auditing isn't turned on by default for Business Basic, Business Standard or Business Premium, so check yours:

1. Sign in to the Microsoft Purview portal.
2. Select the Audit solution card. If you don't see it, select View all solutions, then Audit.
3. If a banner offers to Start recording user and admin activity, select it.

Recording can take up to 60 minutes to start. For licenses other than E5, Microsoft keeps audit records for 180 days.

Check for forwarding

In the Exchange admin center (admin.exchange.microsoft.com), go to Reports → Mail flow and open the Auto forwarded messages report. It shows who forwards mail outside your company and whether that's through an inbox rule, a mail flow rule or mailbox forwarding.

If nobody needs to forward mail outside the company, you can turn it off. In the Defender portal, go to Threat policies → Anti-spam, open the outbound policy, and set Automatic forwarding rules to Off. Microsoft recommends picking On or Off rather than leaving it on Automatic, because Automatic behaves differently from one organization to the next.

If you find a rule nobody recognizes, treat the account as compromised. Reset the password, remove any MFA methods the person doesn't recognize, and work through Microsoft's guide to responding to a compromised email account.

What should you do next?

A good order is:

1. Check your domain's email records with our free DMARC checker.
2. Confirm MFA is on and trim your Global Administrators this week.
3. Turn on DKIM with the Microsoft 365 DKIM setup guide, then add DMARC at p=none.
4. Work through the broader small business cybersecurity checklist for everything outside Microsoft 365.