Microsoft 365 security checklist for small and mid-sized businesses

If you’ve ever taken over a Microsoft 365 tenant from another IT provider, you know the feeling. MFA is “on” but half the accounts never registered. Five people are Global Administrators. Mail forwards to a Gmail address nobody remembers setting up. And there’s an app called “PDF Converter” with access to everyone’s mail.

None of that is unusual. Microsoft 365 is secure when it’s set up well, but a lot of it is left to you. This Microsoft 365 security checklist covers the settings that matter most for small and mid-sized businesses, in the order we’d check them.

Why sign-ins come first

Most Microsoft 365 attacks don’t break anything. They sign in. Microsoft says its research shows multi-factor authentication can block more than 99.2% of account compromise attacks. That’s why the first half of this checklist is about who can sign in, and how.

1. Sign-ins and MFA

Every account has MFA, including admins. If the tenant has no Microsoft Entra ID P1 licences, turn on security defaults. Microsoft’s security defaults require all users to register for MFA, require MFA for admins, block legacy authentication and block device code flow.
Legacy authentication is blocked. Microsoft notes that older protocols don’t support MFA, so an attacker can use them to get around it. Security defaults block them; with Conditional Access, block them with a policy.
Conditional Access is used if you have P1. Microsoft 365 Business Premium includes Microsoft Entra ID P1, which unlocks Conditional Access. Microsoft recommends Conditional Access rather than security defaults once you have P1 or P2. Don’t turn security defaults off until matching policies are on.
Admins use phishing-resistant MFA such as passkeys or security keys, because code-based MFA can be phished in the middle of a login. Read AiTM phishing.
Number matching is on in Microsoft Authenticator, so a flood of prompts can’t be approved by mistake. See how to stop MFA fatigue.

2. Admin accounts

Two to four Global Administrators, no more. Everyone else gets the narrowest role that does the job.
Admins use separate admin accounts, not their everyday mailbox account.
Two break-glass accounts exist, excluded from Conditional Access lock-outs, with long passwords stored offline and sign-ins alerted.
Admin role changes are reviewed monthly. A new admin nobody asked for is one of the clearest signs of an attacker.

3. Accounts that shouldn’t be there

Leavers are disabled the same day, with sessions revoked and mail forwarding removed.
Dormant accounts are reviewed. An account unused for 90 days should be disabled or explained.
Shared mailboxes have sign-in blocked, so nobody can log in to them directly.
Guest accounts are reviewed and removed when the project ends.

4. Email

Automatic forwarding to outside addresses is blocked, with named exceptions.
SPF, DKIM and DMARC are set up for every domain the business sends from, with DMARC moving towards enforcement.
Inbox rules are checked for rules that move or delete mail about invoices, payments or “security”. Attackers use these to hide replies. Read what is BEC.
Safe Links and Safe Attachments are on if the plan includes Microsoft Defender for Office 365. Business Premium includes Plan 1.

The default sharing link is “people in your organisation”, not “anyone”.
“Anyone” links expire, for example after 30 days.
Sensitive sites are reviewed before Microsoft 365 Copilot is switched on, because Copilot can surface anything a person can open. Read what Copilot can see.

6. Connected apps

Users can’t consent to apps on their own, or can only consent to low-risk permissions from verified publishers. Everything else goes to an admin for approval.
Existing app grants are listed and reviewed. Look for apps with access to all mail or all files, apps nobody recognises, and apps approved by people who’ve left.
AI apps are on the list. Note-takers, chatbots and AI assistants often ask for broad mail and file access. See shadow AI detection.

7. Devices

Devices are enrolled in Intune (Business Premium includes Intune Plan 1), with disk encryption and a screen lock.
Microsoft Defender is on every laptop. Business Premium includes Defender for Business. Read is Microsoft Defender enough?
Unmanaged devices get limited access, such as web-only access to files, through Conditional Access.

8. Monitoring and response

The unified audit log is on and searchable.
Someone looks at risky sign-ins. Full risk detail and risk-based Conditional Access need Microsoft Entra ID P2, which isn’t in Business Premium. If you don’t have it, you still need a way to see sign-ins that don’t fit the person.
Someone is alerted out of hours. A stolen session at 2 am is worth little if nobody looks until 9.
There’s a written plan for a compromised account: revoke sessions, reset the password and sign-in methods, remove rules and forwarding, check app grants, and tell the people who need to know.

A worked example: the inherited tenant

This is an illustrative example, not a real client. An MSP takes on a 55-person engineering firm. In the first hour of review, it finds:

Security defaults off, no Conditional Access. Someone turned defaults off two years ago “because MFA annoyed the partners”. 22 accounts have no MFA registered.
Six Global Administrators, including a former office manager’s account that still works.
A forwarding rule on the accounts mailbox sending everything to an outside Gmail address.
An app grant giving a “document signing” app nobody uses full access to all mailboxes.

The order of fixes matters. The MSP removes the forwarding rule and the app grant first, because those are active leaks. Then it disables the former office manager’s account and cuts admins to three. Finally it builds Conditional Access policies for MFA and legacy authentication blocking, tests them on a pilot group, and rolls them out. The whole tenant is in a much better place within a week, and the review becomes a monthly job.

The short version

If you only do five things this week: MFA for everyone, block legacy authentication, cut Global Administrators to four or fewer, block outside forwarding, and review connected apps.

How Centeye helps

Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace, and the changes that follow: new admins, new sign-in methods, inbox rules, forwarding and risky app consent. It ends sessions, resets sign-in methods and removes what an attacker added, at the setting you choose. For MSPs, it covers every client tenant from one console, so the monthly review in this checklist doesn’t have to be done by hand, tenant by tenant.

Want to know where one tenant stands today? The free Identity Exposure Check is a read-only script that checks admins, MFA, foreign sign-ins, unused accounts and app access, and writes a report on your own computer.

Frequently asked questions

What are Microsoft 365 security defaults?

A free, preset bundle of protections from Microsoft. It requires all users to register for MFA, requires MFA for admins, blocks legacy authentication and blocks device code flow. Microsoft recommends it for tenants without Entra ID P1 or P2.

Should I use security defaults or Conditional Access?

If you have Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, use Conditional Access. It gives you more control. Turn on matching policies before you switch security defaults off.

How many Global Administrators should a Microsoft 365 tenant have?

As few as possible. Two to four is a common rule of thumb, plus separate break-glass accounts. Everyone else should get a narrower admin role.

What’s the most common Microsoft 365 security gap?

Two of the most common are incomplete MFA and broad app consent. Both let an attacker in without breaking anything.

It includes Entra ID P1, not P2. Risk-based Conditional Access and full risk detection details need Entra ID P2, per Microsoft’s licensing pages.

New to the terms? See account takeover, OAuth grant, MFA fatigue and password spraying in our glossary.

MFA figure from Microsoft Entra documentation. Security defaults, Conditional Access and licensing (Entra ID P1 in Microsoft 365 Business Premium; risk-based policies need Entra ID P2) as described on Microsoft Learn and Microsoft’s Business Premium FAQ, November 2026. The worked example is illustrative. Microsoft, Microsoft 365, Entra, Intune and Defender are trademarks of the Microsoft group of companies.