Microsoft 365 Security Checklist for Small Businesses

Most small businesses running Microsoft 365 are using a fraction of the security features already included in their licence. Here's a practical checklist covering the items that make the biggest difference, in rough order of priority.

1. Multi-Factor Authentication (MFA) — Everyone, No Exceptions

This is the single highest-impact change available. If MFA isn't enforced for every user, including admins, your business is exposed to the most common account-takeover attacks in circulation. Microsoft's own data consistently shows MFA blocks the overwhelming majority of automated account compromise attempts.

2. Limit Global Admin Accounts

Every business we've reviewed has had more Global Administrator accounts than it needs — often including accounts nobody remembers creating. A good rule: no more than two Global Admins, with day-to-day admin tasks handled through more limited role assignments.

3. Conditional Access Policies

Conditional Access lets you set rules like "block sign-in from outside the UK" or "require MFA when signing in from an unmanaged device." Available on most business-tier 365 plans, it's one of the most underused security tools we see.

4. Data Loss Prevention (DLP) Basics

Even a basic DLP policy — flagging when card numbers or National Insurance numbers are shared externally via email — closes a surprisingly common accidental data leak.

5. Mailbox and Email Security

SPF, DKIM, and DMARC records correctly configured on your domain, to stop your domain being spoofed
Safe Links and Safe Attachments enabled (included in most 365 Business Premium plans)
Auto-forwarding to external addresses disabled by default

6. Backup — 365 Isn't Automatically Backed Up the Way You Think

Microsoft's native retention policies are not the same as a true backup. Deleted or corrupted SharePoint, Teams, or mailbox data can be permanently unrecoverable outside the retention window without a proper third-party backup solution in place.

7. Basic Security Awareness for Your Team

The best technical controls in the world won't stop someone clicking a convincing phishing link. A short, plain-English briefing for your team on spotting suspicious emails is one of the cheapest security investments available.

If you're not sure how many of these are actually switched on in your tenant right now, that's usually the first sign it's worth a proper review.