Microsoft 365 Security Checklist for Small Businesses

Most small businesses I work with in Brisbane are using Microsoft 365, but very few have it configured securely. Here's a practical checklist based on what I see most often.

1. Enable Multi-Factor Authentication (MFA) for Everyone

This is the single most important thing you can do. MFA blocks 99.9% of automated attacks. Make sure every user, especially admins, has MFA enabled. Use the Microsoft Authenticator app, not SMS codes.

2. Set Up Conditional Access Policies

Conditional access lets you control when and how users can access your systems. For example, you can require MFA when logging in from outside Australia, or block access from unmanaged devices. This requires Azure AD P1 licensing.

3. Configure Email Authentication (SPF, DKIM, DMARC)

Make sure your domain has proper SPF, DKIM, and DMARC records. Without them, anyone can spoof your email address. Aim for a DMARC policy of 'reject' to fully protect your domain.

4. Review Admin Accounts

Global admin accounts are the keys to the kingdom. Make sure you have no more than 2-3, they all have MFA, and you have a break-glass emergency access account. Never use admin accounts for day-to-day email.

5. Enable Audit Logging

Turn on unified audit logging so you have a record of who did what and when. This is critical for investigating security incidents and is often a compliance requirement.

6. Review Sharing Settings

Check your SharePoint and OneDrive sharing settings. Many businesses have external sharing set to 'anyone with a link' by default, which means files can be accessed without authentication. Tighten this to 'specific people' or 'existing guests'.

7. Configure Anti-Phishing Policies

Microsoft Defender for Office 365 includes anti-phishing protection, but the default settings are often too permissive. Review and tighten impersonation protection, especially for your CEO and finance team.

Want a Professional Review?

If you're not sure where your M365 security stands, I offer a Microsoft 365 Security & Identity Health Check. I'll review your setup against these items (and more), and give you a prioritised action plan in plain English.