What's the single most important Microsoft 365 security setting for a small business?

Multi-factor authentication on every account, admins first. Stolen passwords are the most common way small tenants get breached, and MFA stops the vast majority of those attacks. If you do nothing else this week, turn on MFA for all users.

Do small businesses need Microsoft 365 Business Premium for security?

You can secure a tenant on lower plans, but Business Premium bundles the security features that matter — Conditional Access, Defender for Office 365, Intune device management, and data protection — at a price aimed at small organizations. For most small businesses it's the most cost-effective way to get a full security stack.

What is Microsoft Secure Score and should I use it?

Secure Score is a dashboard that rates your tenant's security configuration and gives ranked, specific recommendations with the points each one earns. It's a good prioritised to-do list for a small business because it tells you what to fix next and roughly how much it helps. Treat it as guidance, not a target to game.

How many global admins should a small business have?

As few as possible — two to four is a common range. You want at least two so you're never locked out, and you keep the number low because every global admin is a high-value target. Give everyday admins the least-privileged role that covers their job instead of global admin.

Is the audit log on by default in Microsoft 365?

For most newer tenants auditing is on by default, but you should confirm it rather than assume. Without it you have no record of who did what if an incident happens, and you can't investigate after the fact. Check it's enabled in the Microsoft Purview portal early.

How often should a small business review Microsoft 365 security?

Do a quick monthly check of Secure Score, sign-in logs, and admin accounts, and a deeper review every quarter covering external sharing, guest accounts, and mail forwarding rules. Security drifts as people join, leave, and change roles, so a periodic review catches what one-time setup misses.

Microsoft 365 Security Checklist (Small Business)

Small businesses get breached through Microsoft 365 for boring reasons: a reused password with no MFA, a global admin account everyone shares, an inbox rule quietly forwarding mail to an attacker. None of it is sophisticated. The good news is the fixes aren’t either — most of this checklist is settings you can change in an afternoon, and the highest-impact ones cost nothing beyond your time.

This is a prioritised list, not an exhaustive one. It’s ordered roughly by impact per effort, so the top items stop the most common attacks and the later ones tighten the edges. Work down it, tick things off, and you’ll close the gaps that account for the bulk of small-tenant compromises. Where a step deserves its own walkthrough, there’s a link to a deeper guide.

Start here: identity is the front door

Almost every Microsoft 365 breach starts with a credential. Lock down identity first and everything else gets easier.

Turn on MFA for everyone

This is the one that matters most. A stolen password is useless to an attacker who can’t pass the second factor. Enable MFA for all users, and do your admin accounts first since they’re the highest-value targets.

If you’re on a plan without Conditional Access, Security Defaults is a free, one-switch way to enforce MFA across the tenant — far better than nothing. The moment you need exceptions (a service account, a trusted location), graduate to Conditional Access. Our walkthrough on enabling MFA for Microsoft 365 users covers both paths, and if MFA misbehaves after rollout, fixing MFA that isn’t working saves you the help-desk scramble.

Use Conditional Access if your plan includes it

With Entra ID P1 (included in Business Premium) you move past all-or-nothing to targeted policies: require MFA, block legacy authentication, and require managed devices for sensitive apps. The single highest-value policy after “require MFA” is block legacy authentication, because those old protocols can’t do MFA and are exactly what password-spray attacks abuse. See Conditional Access explained for how to roll policies out in report-only mode without locking anyone out.

Clean up admin accounts

Three habits, all free:

Limit global admins. Keep the count low (two to four is typical) and give everyone else the least-privileged role for their job.
Don’t use admin accounts for daily work. Separate the account that reads email from the account that manages the tenant.
Review who has what. People change roles and keep old permissions. Check the admin list periodically and strip access that’s no longer needed.

Identity quick wins, by impact

MFA for all users	Highest impact, free on every plan via Security Defaults
Block legacy authentication	High impact, needs Conditional Access (P1)
Limit global admins	High impact, free
Separate admin and daily-use accounts	Medium impact, free
Break-glass accounts	Essential safety net before enforcing policies

Lock down email, because that’s where attacks land

Email is the delivery mechanism for most attacks a small business sees. A few settings cut the bulk of it.

Stop auto-forwarding to external addresses

A favourite attacker trick after compromising an account is a hidden rule that forwards a copy of every message to an outside address. Microsoft 365 blocks automatic external forwarding by default through the outbound spam policy — confirm that’s still the case, and audit existing mailboxes for forwarding rules you didn’t set.

Turn on anti-phishing protection

Configure the anti-phishing policy in Microsoft Defender for Office 365 so impersonation and spoofing protection are active. If your plan includes it, enable Safe Links and Safe Attachments so links are checked at click-time and attachments are detonated before delivery. The comparison in Safe Links vs Safe Attachments explains what each one actually does. For the wider picture, protecting Microsoft 365 from phishing ties the email controls together.

Once identity and email are handled, look at where your data can go.

Default sharing settings are often more open than a small business needs. Decide whether files should be shareable with anyone via anonymous links, or only with specific authenticated people, and set the organization-level sharing controls to match. “Anyone” links are convenient and also the easiest way for a document to end up somewhere you didn’t intend.

Manage guest access

Guests accumulate. Every external person you’ve ever shared a file or a Team with may still have an account. Review the guest list periodically and remove access that’s no longer needed.

Know your recovery options

Security includes being able to recover. Make sure you know how to get back deleted mail and files — Exchange Online retains deleted emails for a recovery window, and the retention and recycle-bin settings cover SharePoint and OneDrive. This won’t stop an attack, but it’s what limits the damage of one. Note that Microsoft 365’s native retention is not a full backup; many small businesses add third-party backup for longer-term recovery.

Turn on monitoring so you’d actually notice

You can’t respond to what you can’t see. These make sure an incident leaves a trail.

Confirm the audit log is on

The unified audit log records who did what across Exchange, SharePoint, and Teams. For most newer tenants it’s on by default, but verify it in the Microsoft Purview portal rather than assuming. Without it, investigating an incident after the fact is nearly impossible.

The Entra sign-in logs show every authentication attempt and why each succeeded or failed. Knowing how to filter them — by user, by failure, by location — turns “something feels off” into a concrete answer. Our guide on checking Microsoft 365 sign-in logs walks through reading failure codes and spotting suspicious access. Remember the default retention is short, so set up log export if you need history.

Use Secure Score as your to-do list

Microsoft Secure Score rates your configuration and hands you a ranked list of improvements with the points each earns. It’s a genuinely useful prioritised backlog for a small business because it tells you what to do next and roughly how much each item helps. Check it monthly and work the top recommendations.

Microsoft 365 small-business security checklist

MFA enabled for every user, admins first
Legacy authentication blocked (Conditional Access)
Global admins limited; separate admin and daily accounts
Two break-glass accounts created, excluded from policies, and tested
Automatic external forwarding confirmed blocked; mailboxes audited for rogue rules
Anti-phishing / preset security policy enabled (Standard or Strict)
Safe Links and Safe Attachments on (if licensed)
External sharing in SharePoint/OneDrive reviewed and scoped
Guest accounts reviewed and stale ones removed
Unified audit log confirmed enabled
Secure Score reviewed and top recommendations actioned

Keep it from drifting

Security isn’t a one-time setup. People join, leave, and change roles, and the tenant config drifts with them. A light recurring rhythm keeps it honest:

A simple review cadence

Monthly	Secure Score, sign-in log spot-check, admin account list
Quarterly	External sharing, guest accounts, mail forwarding rules, license/role cleanup
On staff change	Disable departing users promptly, reassign mailboxes, remove their access

The departing-employee step is the one small businesses miss most. An account that’s still enabled after someone leaves is a standing risk, so make offboarding a checklist item alongside the HR paperwork.

Wrapping up

You don’t need a security team to run a reasonably secure Microsoft 365 tenant. Start with identity — MFA for everyone, block legacy auth, trim admins, set up break-glass accounts. Lock down email with anti-phishing and confirm external forwarding is blocked. Control where your data can go through sharing and guest reviews. Then turn on monitoring so you’d actually notice a problem, and let Secure Score tell you what to fix next. Work the checklist top to bottom, then keep the monthly and quarterly reviews so it doesn’t quietly drift back open.

If you’re setting up a tenant from scratch, pair this with enabling MFA and Conditional Access as your first two jobs — they close the largest gap for the least effort.

Microsoft 365 Security Checklist for Small Businesses