Last updated: October 2026
Disclosure: The founder of WavesRank works at an IT company that is a Microsoft partner and sells Microsoft 365 licences. This guide contains no affiliate links. See our Affiliate Disclosure and Editorial Policy.
Microsoft 365 runs email, files and Teams for millions of small businesses, which makes it one of the most attacked platforms in the world. Out of the box it is reasonably secure, but several important protections are off by default or depend on your plan.
This guide lists 12 Microsoft 365 security settings every small business should check, in order of importance, with where to find each one. Most take under 10 minutes.
Before you start: which plan do you have?
Some settings depend on your licence:
| Plan | What it adds for security |
|---|---|
| Business Basic / Standard | Exchange Online Protection (spam, malware and basic anti-phishing), security defaults, basic audit logs |
| Business Premium | Everything above, plus Microsoft Defender for Office 365 Plan 1, Defender for Business (endpoint protection), Intune device management and Entra ID P1 (Conditional Access) |
If you have more than a few staff and handle sensitive data, Business Premium is usually worth it for security alone. The settings below are marked where they need it.
The 12 settings
1. Require multi-factor authentication for everyone
This is the single most important step. Either:
- Turn on Security defaults (free, all plans): in the Microsoft Entra admin center, go to Identity → Overview → Properties → Manage security defaults and set it to Enabled. This requires MFA registration for all users and blocks older sign-in methods that can’t do MFA.
- Or use Conditional Access (Business Premium): create policies requiring MFA for all users. If you use Conditional Access, security defaults must be off.
Microsoft also now requires MFA to sign in to its admin portals, so admins must be set up first.
2. Block legacy authentication
Older protocols (such as basic authentication for POP, IMAP and older Office clients) cannot do MFA, so attackers use them to bypass it. Security defaults block them automatically; with Conditional Access, add a policy that blocks “other clients”.
3. Protect admin accounts
- Give each admin a separate admin account, not their everyday mailbox.
- Keep the number of Global Administrators to two to four and give others narrower roles, such as Exchange or User Administrator.
- Create one emergency (“break-glass”) admin account with a long password stored securely, excluded from policies that could lock you out.
Check this in the Microsoft 365 admin center → Roles → Role assignments.
4. Remove old partner and delegated admin access
If a previous IT provider ever managed your tenant, they may still have delegated admin (GDAP) access. Go to Microsoft 365 admin center → Settings → Partner relationships and remove any partner you no longer work with. We have seen what happens when a former provider keeps access; read our real case study.
5. Turn on the preset security policies for email
In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Preset security policies and apply the Standard protection profile to all users. This applies Microsoft’s recommended anti-spam, anti-malware and anti-phishing settings in one step, instead of tuning each policy by hand.
6. Turn on Safe Links and Safe Attachments (Business Premium)
With Defender for Office 365, Safe Links checks links when they are clicked and Safe Attachments opens attachments in a sandbox before delivery. The Standard preset policy turns both on.
7. Set up SPF, DKIM and DMARC for your domain
These records stop criminals sending email that fakes your domain. Microsoft 365 gives you the DKIM values, but you must publish all three records yourself. Follow our DMARC setup guide, and see how to stop email spoofing for the inbound settings.
8. Block automatic forwarding to external addresses
After stealing a password, attackers often set up a rule that forwards all email to an outside address. In the Defender portal, open Anti-spam policies → Anti-spam outbound policy (Default) and set Automatic forwarding rules to Off – Forwarding is disabled. Add exceptions only for mailboxes that genuinely need it.
9. Limit external sharing in SharePoint and OneDrive
In the SharePoint admin center → Policies → Sharing, reduce sharing from “Anyone” links to “New and existing guests” or tighter, and set links to expire. This prevents company files from being shared with anyone who has the link.
10. Stop users approving risky apps
Attackers trick users into granting third-party apps access to their mailbox (“consent phishing”). In the Entra admin center → Enterprise apps → Consent and permissions, allow user consent only for apps from verified publishers with low-risk permissions, or require admin approval.
11. Make sure audit logging is on and review alerts
Audit logs let you investigate what happened after an incident. In the Microsoft Purview portal, check that Audit is turned on, and in the Defender portal review the default alert policies, such as alerts for new forwarding rules or unusual sign-ins. Make sure alerts go to a mailbox someone reads.
12. Check your Microsoft Secure Score
In the Defender portal, open Secure Score. It lists improvement actions for your tenant, ranked by impact. Work through the top recommendations, and check the score monthly.
Bonus: protect devices and data
- Manage devices with Intune and Defender for Business (Business Premium) so laptops are encrypted, updated and protected.
- Back up Microsoft 365 data. Microsoft keeps your service running, but recovering deleted or ransomware-encrypted data beyond the built-in retention periods is your responsibility. A third-party Microsoft 365 backup is worth considering; see our backup solutions comparison.
- Use a password manager for the other accounts your staff use; see our password manager comparison.
Microsoft 365 security checklist
| # | Setting | Plan |
|---|---|---|
| 1 | MFA for all users (security defaults or Conditional Access) | All |
| 2 | Legacy authentication blocked | All |
| 3 | Separate admin accounts, few Global Admins, break-glass account | All |
| 4 | Old partner and delegated admin access removed | All |
| 5 | Standard preset security policy applied | All |
| 6 | Safe Links and Safe Attachments on | Business Premium |
| 7 | SPF, DKIM and DMARC published | All |
| 8 | External auto-forwarding blocked | All |
| 9 | SharePoint and OneDrive sharing limited | All |
| 10 | User consent to apps restricted | All |
| 11 | Audit logging on, alerts reviewed | All |
| 12 | Secure Score reviewed monthly | All |
For the wider picture beyond Microsoft 365, see our small business cybersecurity checklist.
Frequently asked questions
Is Microsoft 365 secure by default? It has solid basic protection, and newer tenants have security defaults turned on. But many older tenants don’t, and settings such as external forwarding, sharing links, app consent and DMARC need checking by an admin.
Is Business Premium worth it for security? For most businesses with sensitive data or more than a handful of staff, yes. It adds Defender for Office 365, endpoint protection, device management and Conditional Access, which would cost more to buy separately.
Do I still need MFA if I have strong passwords? Yes. Passwords are stolen through phishing and data breaches regardless of how strong they are. MFA blocks most attacks that use stolen passwords.
Does Microsoft back up my Microsoft 365 data? Microsoft protects against its own infrastructure failures and offers limited retention and recycle-bin periods. It is not a full backup of your data against deletion, ransomware or a malicious insider over the long term.
Related guides
- DMARC policy explained: none vs quarantine vs reject
- 1Password vs Bitwarden vs NordPass vs Keeper for business
Microsoft regularly renames portals and moves settings. This guide reflects the admin centers as of October 2026.