Microsoft 365 security checklist for small businesses

Why Microsoft 365 is a target

Your Microsoft 365 account holds email, files, contacts and the ability to send invoices and payment instructions in your name. Attackers who get into one mailbox commonly read it quietly, set up forwarding rules, and then send fake payment requests to customers or suppliers. This is known as business email compromise, and it is one of the most costly attacks on small businesses.

Microsoft secures its data centres and the service. Your business is responsible for who can sign in, what they can reach, and how the settings are configured.

The checklist

Multi-factor authentication for everyone

Turn on MFA for every account, ideally with the Microsoft Authenticator app. Use Microsoft's free security defaults, or Conditional Access policies on Business Premium.

Block older sign-in methods

Make sure legacy sign-in methods that skip MFA are blocked. Security defaults do this for you.

Separate admin accounts

Do daily work from an ordinary account and keep global admin rights on separate accounts. Microsoft recommends at least two and fewer than five global admins, including an emergency access account kept safe.

Accounts in the business's name

The tenant, domain and main admin account should belong to the business, not to a former employee or supplier.

Phishing and malware protection

Check the anti-phishing, anti-spam and anti-malware policies. Business Premium adds Safe Links and Safe Attachments.

Stop automatic forwarding outside the business

Automatic forwarding to outside addresses is a common sign of a compromised mailbox. Block it, and allow exceptions only where there is a business reason.

SPF, DKIM and DMARC

Set up the records that prove your email is genuine and stop others sending email in your name.

Sharing settings

Review who files in OneDrive and SharePoint can be shared with, and whether 'Anyone with the link' sharing should be allowed.

Audit logging

Make sure audit logging is on, so you can see who signed in and what changed. Standard audit records are kept for a limited period, so act on alerts promptly.

Device protection

Keep Windows, macOS and phones updated, encrypt laptops with BitLocker or FileVault, and use Intune on Business Premium to manage and wipe lost devices.

A leaver process

When someone leaves: block sign-in, reset the password, sign them out everywhere, keep the mailbox and OneDrive if needed, and reclaim the licence.

Backup

Microsoft's retention is not a long-term backup. Decide what needs a separate backup.

What to check every month

• Microsoft Secure Score in the Microsoft Defender portal, and the recommended actions it lists.
• Risky sign-ins and sign-ins from unexpected countries.
• New inbox rules or forwarding on mailboxes, especially finance mailboxes.
• Users with admin roles, and accounts belonging to people who have left.
• Licences assigned to nobody or to former staff.

If you think an account has been compromised

1. Contain itReset the password, sign the user out of all sessions and check MFA methods for anything added by the attacker.
2. Look for changesInbox rules, forwarding, app consents and recent emails sent from the account.
3. Warn the people affectedTell customers and suppliers who may have received fake payment instructions, by phone.
4. Consider your obligationsIf personal data may have been exposed, your business may need to notify the Data Protection Commission within 72 hours. Take advice on your situation.
5. Fix the causeClose the gap that let the attacker in, so it does not happen again.

This checklist is general guidance, not a full security assessment. Ireland's National Cyber Security Centre (ncsc.gov.ie) also publishes guidance for small businesses.

Questions

Related guides