Seven Microsoft 365 security settings every small business should check

Microsoft 365 includes strong security features, but many of them depend on how your tenant is configured. If your business set up Microsoft 365 quickly — or inherited it from someone else — these seven areas are worth checking first.

1. Multi-factor authentication for everyone

Passwords alone are the most common way business accounts are taken over. Multi-factor authentication (MFA) adds a second check, such as an approval in the Microsoft Authenticator app.

• If you don't use Conditional Access, Microsoft's security defaults are a free way to require MFA and block older sign-in methods.
• If your licenses include Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, for example), Conditional Access policies give you finer control.

Start with administrators, then roll out to everyone with clear instructions.

2. Fewer, separate administrator accounts

Global Administrator is the most powerful role in your tenant. Keep the number of people who hold it small, and have administrators use a separate admin account for admin work instead of their everyday mailbox account. Use more limited roles (such as User Administrator or Exchange Administrator) when they're enough for the task.

3. Email authentication: SPF, DKIM, and DMARC

These DNS records help receiving mail servers confirm that email claiming to come from your domain really does. They make it harder for criminals to impersonate you to customers and vendors.

• SPF lists which services may send mail for your domain.
• DKIM adds a cryptographic signature to outgoing messages.
• DMARC tells receivers what to do when checks fail, and sends you reports.

4. Automatic forwarding to outside addresses

Attackers who get into a mailbox often create a rule that silently forwards mail to an external address. Review your outbound settings and mailbox rules, and allow external forwarding only where there's a clear business need.

5. External sharing in SharePoint and OneDrive

"Anyone with the link" sharing is convenient — and easy to forget about. Decide what level of external sharing your business actually needs, consider expiration for sharing links, and periodically review what's shared outside the organization.

6. Audit logging

When something goes wrong, logs are how you find out what happened. Confirm that audit logging is turned on in Microsoft Purview, and know how long your licenses retain the data.

7. Departed users

Accounts belonging to people who no longer work with you are a common and avoidable risk. Use a consistent offboarding checklist: block sign-in, reset the password, revoke sessions, transfer or convert the mailbox, and review any files they owned.

Where to go from here

Microsoft's Secure Score (in the Microsoft Defender portal) is a useful starting point that lists recommended improvements for your tenant. Treat it as a guide rather than a grade — not every recommendation fits every business.

If you'd like a second opinion, our Microsoft 365 Security Assessment is a read-only review that produces a prioritized, plain-language report.