Microsoft 365 Security Checklist for Small Business: 12 Controls in Priority Order

Twelve controls, in the order Frontrow implements them, each one chosen because it reduces the blast radius of the failure that comes after it. An internal IT lead with Global Administrator access can complete items one to six in a working week. The rest depend on how many devices you have and how much data you hold.

Every item below states the licence it needs, so a Business Standard tenant can see exactly which lines it cannot action and what the upgrade buys. Every item also carries a verification step, because the difference between a control that is switched on and a control that is working is the difference between an insurance claim that pays and one that does not.

The checklist at a glance

1. Create two break-glass accounts before you change anything

Every control after this one can lock someone out, including you. Microsoft's guidance is to keep at least two emergency access accounts: cloud-only, not tied to any individual person, not enrolled in the multifactor authentication method everyone else uses, with long random passwords stored somewhere physical or in a password manager the whole leadership team can reach. Exclude them from Conditional Access policies, and only those.

Check it worked: sign in to one of them in a private browser window today, and put a calendar reminder to repeat that every quarter. An emergency account nobody has tested is not an emergency account.

2. Put every administrator on phishing-resistant MFA

Standard push multifactor authentication stops password-only attacks. It does not stop an attacker-in-the-middle phishing kit, which proxies the real sign-in page and relays the code or the approval as the user enters it. Phishing-resistant methods are bound to the sign-in surface so there is nothing for the kit to relay: Windows Hello for Business, FIDO2 security keys, passkeys, or certificate-based authentication.

Microsoft ships a Conditional Access template for exactly this, requiring phishing-resistant MFA for administrator roles. It needs Microsoft Entra ID P1, which Business Premium and E3 both include. Start with administrators because a compromised Global Administrator is the difference between an incident and a catastrophe, then extend to finance staff, who are the other high-value target in a small business.

Check it worked: sign in as an administrator from a device that has no registered passkey or security key and confirm the sign-in is blocked rather than falling back to an approval push. Then check the Conditional Access policy's Users tab and confirm the only exclusions are the two break-glass accounts from step one.

3. Get multifactor authentication onto every user account

Tenants created since late 2019 generally have Microsoft Entra security defaults enabled, which require every user to register for multifactor authentication and use number matching in Microsoft Authenticator. Number matching matters: it defeats the approval-fatigue tactic where an attacker fires push prompts until someone taps accept. For a small business with no Conditional Access, security defaults are a genuinely good baseline and should stay on.

If you have Business Premium and want Conditional Access instead, remember that the two are mutually exclusive. Turning off security defaults without finishing the replacement policies is the most common self-inflicted wound Frontrow finds in Australian tenants, and it leaves an organisation with neither protection. Microsoft's secure foundation templates rebuild the baseline in four policies: require MFA for all users, require MFA for administrators, block legacy authentication, and require MFA for Azure management.

Check it worked: in the Microsoft Entra admin center open Monitoring and health, then Sign-in logs, filter the last seven days, and look at the Authentication requirement column. Any successful interactive sign-in showing single-factor authentication is a gap, and the user or application behind it is your next investigation.

4. Block legacy authentication

Older protocols such as IMAP, POP3 and SMTP basic authentication cannot perform multifactor authentication, which makes them the standing workaround for anyone holding a stolen password. Microsoft states that most compromising sign-in attempts come from legacy authentication. Security defaults block it automatically, along with device code flow. A Conditional Access tenant needs the explicit block-legacy-authentication policy.

This is one of the two controls that can break things. Old multifunction printers that scan to email, line-of-business applications that send alerts through SMTP, and unattended scripts are the usual casualties.

Check it worked, and check it first: in the Entra sign-in logs, add the Client app column and filter for the legacy clients. That shows you exactly which accounts and applications will break before you enforce the block, so the printer gets moved to authenticated SMTP submission or a dedicated connector rather than discovered at 8am on a Monday.

5. Turn on the preset security policies

This is the highest-value ten minutes available to a Business Premium tenant, and it is the step most often missed because the licence already appears in the bill. Microsoft Defender for Office 365 Plan 1 ships three preset security policies. Built-in protection is on for everyone by default and provides basic Safe Links and Safe Attachments only. Standard protection and Strict protection are both off until an administrator turns them on and assigns users.

The practical shape for a small business: Standard protection assigned to all users, Strict protection assigned to the leadership team, finance and anyone who can move money or change bank details. Strict quarantines more aggressively, which is the right trade for the accounts an attacker is actually targeting. The settings inside the presets are not configurable by design, which is a feature when nobody on staff tunes anti-spam policies for a living.

Go to the Microsoft Defender portal, Email and collaboration, Policies and rules, Threat policies, then Preset Security Policies. The direct URL is security.microsoft.com/presetSecurityPolicies.

Check it worked: Microsoft's own verification method is to use a setting whose default differs from Standard, which differs again from Strict. Bulk mail is the easy one. At a bulk complaint level of 6 or higher, a Standard protection user gets the message in Junk Email, while a Strict protection user gets it quarantined. Confirm on a real mailbox in each group rather than assuming from the toggle.

6. Turn off automatic external forwarding

When an attacker gets into a mailbox, one of the first moves is a rule that silently forwards mail to an outside address. From that point they read invoice traffic in real time and keep receiving copies after the password is reset. Blocking automatic external forwarding removes the surveillance channel that makes a convincing fake invoice possible.

The control lives in the outbound spam policy in the Microsoft Defender portal and has three values: on, off, and the default of Automatic, which is system-controlled. That default is ambiguous by design and behaves differently depending on tenant age and history, so Microsoft's guidance is to set it explicitly to off rather than rely on it. A rule that then tries to forward externally generates a bounce with code 5.7.520. Internal forwarding is untouched, and a genuine business exception can be handled per domain through remote domain settings.

Check it worked, and check it first: open the Auto forwarded messages report before changing the setting. It lists every mailbox currently forwarding externally. Anything unexpected on that list is a possible live compromise, not a cleanup item, and belongs in the compromised-account runbook rather than in this checklist.

7. Deploy the Report Phishing button and actually watch it

User reporting is available on every Microsoft 365 plan with a cloud mailbox and it is the cheapest detection capability a small business owns. The built-in Report button in Outlook lets a user report phishing and junk, and the user reported settings in the Defender portal decide where those reports go: to Microsoft, to an internal mailbox you nominate, or both.

Point reports at a monitored internal mailbox as well as Microsoft. The point is not the Microsoft submission, useful as it is. The point is that when three people in the same hour report a message about an invoice, somebody inside the business sees the pattern that afternoon rather than reading about it in a bank statement.

Check it worked: send a harmless test message to yourself, report it with the button, and confirm it lands in the nominated mailbox and appears under Submissions in the Defender portal. Then tell every staff member the button exists. A reporting channel nobody has been told about collects nothing.

8. Onboard every device to Defender for Business

Business Premium includes Microsoft Defender for Business, a genuine endpoint detection and response product for organisations up to 300 users. It only protects devices that have been onboarded to it. Frontrow's most common finding on a first review is a tenant paying for this every month with a device count in the portal well below the headcount on the payroll.

Servers are the trap. Windows Server and Linux server protection is not included under Defender for Business, Defender for Endpoint Plan 1 or Plan 2. It needs a separate licence in every case. A business still running a file server or a line-of-business application server is the most likely to assume otherwise.

Check it worked: Microsoft Defender portal, Assets, then Devices. Count the onboarded devices and compare against your staff headcount plus any shared machines. Then open one device and confirm its health status reports the sensor as active rather than inactive or misconfigured.

9. Enrol devices in Intune with a compliance policy

Microsoft Intune Plan 1 comes with Business Premium and does the work the antivirus cannot: enrolment, disk encryption policy, operating system and application update rings, and application protection for personal phones that never get enrolled. It also produces the device compliance signal that Conditional Access reads, which is what lets you write the rule that company data is only reachable from a managed, encrypted, patched machine.

Start narrow. One compliance policy requiring disk encryption, a minimum operating system version and a screen lock covers more real risk than a hundred configuration settings nobody reviews. Business Basic and Standard tenants get Basic Mobility and Security instead, which manages mobile devices and not applications.

Check it worked: Intune admin center, Devices, then Compliance. A device showing as not evaluated is not the same as compliant. Then confirm the BitLocker or FileVault recovery keys are actually escrowed in Entra ID, because that is the detail that decides whether a lost laptop is an inconvenience or a notifiable data breach.

10. Review who holds administrator roles

Small tenants accumulate administrators. The bookkeeper who needed to add a user once, the former managed service provider, the developer who set up a mail connector in 2021. Microsoft's own guidance is least privilege: Global Administrator is for emergencies and for work that genuinely cannot be done in a narrower role.

Aim for a small number of named Global Administrators plus the two break-glass accounts, with everyone else on the narrowest role that does their job. Administrators should also hold a separate account from their day-to-day mailbox, because an administrator who reads email as an administrator has combined the two things an attacker needs.

Check it worked: Microsoft Entra admin center, Roles and administrators, then open Global Administrator and read the list out loud to the business owner. Anyone the owner cannot immediately account for is the finding. Time-bound role activation through Privileged Identity Management is the mature answer, and it requires Entra ID P2 rather than Business Premium.

11. Establish the backup position and test a restore

Microsoft replicates your data across datacentres for availability and provides finite recycle bins for everyday mistakes. Neither is a backup. Replication faithfully copies a deletion to every datacentre within minutes, and the recycle bin windows are measured in weeks, not years. The recovery you need after a ransomware incident or a departing employee emptying a mailbox is point-in-time restore, which is a separate product decision.

Three options exist and they are not interchangeable: native recycle bins for everyday recovery, Microsoft 365 Backup as a first-party pay-as-you-go service for point-in-time restore, and third-party backup where you need multi-year retention, immutability, or a copy that survives losing access to the tenant itself. Frontrow's separate guide on Microsoft 365 backup works through which of the three a business actually needs.

Check it worked: restore something. Pick a real file from a real site, restore it to a different location, and time how long the whole process took from first phone call to working document. A backup that has never been restored is a theory. Write the elapsed time down, because that number is your recovery time objective whether you chose it or not.

12. Publish one data loss prevention policy for what you actually hold

Business Premium includes Microsoft Purview data loss prevention and sensitivity labels. The failure mode here is ambition: businesses design a twelve-label taxonomy, stall on the workshop, and ship nothing. One policy covering the personal information your business genuinely holds beats a perfect scheme that never goes live.

For most Australian small businesses that means tax file numbers, Medicare numbers, bank account details, driver licence numbers and passport numbers, with the policy set to warn the sender rather than block outright for the first month. Run it in that mode, see what it catches, then decide what to block. Under the Notifiable Data Breaches scheme an organisation has 30 days to assess a suspected eligible breach, and knowing which documents hold personal information is what makes that assessment possible at all.

Check it worked: send a test email containing a fake tax file number to an external address you control, and confirm the policy tip appears for the sender and the match shows in the Purview activity explorer. A policy that exists and matches nothing is usually scoped to the wrong locations.

The thirteenth item, which is not a setting

Decide who reads the alerts, on what day, and what happens when they find something. Automated investigation in Defender for Business closes routine detections on its own, but genuine incidents queue in the portal waiting for a human decision, and the detections that precede a ransomware deployment often arrive days before the encryption does. They only help if somebody reads them that day.

Some businesses give this to internal IT as a daily habit. Others have their Microsoft partner watch it as part of a managed service, which is the arrangement Frontrow runs for its Australian clients. Either model works. Having no model is the failure state, and no licence fixes it.

Write the incident contact card while nothing is on fire: who to call inside the business, who to call outside it, the ACSC report line, the bank's fraud line, and the insurer's notification number. Print it. During an incident the credentials you need are frequently in the system you have just been locked out of.