A Microsoft 365 security baseline for small businesses

By Akash Sengar · 6 October 2026 · 5 min read

Before you change anything

This baseline is for small business tenants. Each item says why it matters and where to find it, with a link to Microsoft Learn. Portals and menu names change from time to time; the linked pages are kept current by Microsoft.

• Create two emergency access (break-glass) accounts first, excluded from policies that could lock everyone out, with long passwords stored securely.
• Tell users before you enforce MFA, and give them a date.
• Make one change at a time, and test with a pilot group where the setting allows it.

1. MFA for every user

Why: stolen passwords are the usual way into a tenant. Multi-factor authentication stops most of those sign-ins. Where: through security defaults or Conditional Access, below. Prefer the Microsoft Authenticator app or passkeys over SMS where you can. Include every account, not just admins.

2. Security defaults or Conditional Access

Security defaults are free and give every tenant a baseline: MFA registration for all users, MFA for administrators, MFA when needed for users, and blocking legacy authentication. Microsoft turns them on for new tenants. Where: Microsoft Entra admin centre, Identity, Overview, Properties, Manage security defaults.

If your licences include Microsoft Entra ID P1 (included in Microsoft 365 Business Premium), you can use Conditional Access instead for finer control, such as requiring compliant devices. Security defaults and Conditional Access cannot be used together, so create equivalent policies before you switch defaults off.

3. Block legacy authentication

Why: older protocols cannot do MFA, so attackers use them to try stolen passwords. Where: security defaults block it. With Conditional Access, create a policy following Microsoft's block legacy authentication guidance. Check sign-in logs first for any device or app still using it, such as old scanners or mail clients, and move them to modern methods.

4. Admin role hygiene

Why: a compromised Global Administrator controls everything. Microsoft's best practices for Microsoft Entra roles recommend fewer than five Global Administrators and using the least privileged role for each task.

• Give admins separate admin accounts, not their daily mailbox account, and no licence for mail on the admin account.
• Use narrower roles, such as User Administrator or Exchange Administrator, instead of Global Administrator.
• Review role assignments regularly. If you have Entra ID P2, Privileged Identity Management gives just-in-time admin access.

Where: Microsoft Entra admin centre, Identity, Roles and admins.

5. Defender for Office 365 policies

Why: phishing and malicious attachments remain the main email threat. Every tenant has Exchange Online Protection; Defender for Office 365 (included in Business Premium) adds Safe Links and Safe Attachments. Where: Microsoft Defender portal, Email and collaboration, Policies and rules, Threat policies. The simplest route is preset security policies: apply the Standard or Strict protection profile to all users, rather than tuning dozens of settings by hand.

6. External sharing settings

Why: "Anyone" links can be forwarded and opened without sign-in. Where: SharePoint admin centre, Policies, Sharing (see Manage sharing settings). Decide the organisation-wide level for SharePoint and OneDrive. Many small businesses choose "New and existing guests" so external people must sign in, set default links to "Specific people", and set expiry on any anonymous links they still allow.

7. Audit logging

Why: when something goes wrong, the audit log shows who did what. Where: Microsoft Purview portal, Audit. Microsoft turns auditing on by default for most organisations, but check that it is on. Note the retention period your licence gives, and export logs if you need them for longer.

8. Mailbox forwarding rules

Why: after a mailbox is compromised, attackers often create rules that forward mail outside the organisation or hide replies. Where: outbound spam filter policies in the Defender portal control automatic external forwarding; see Control automatic external email forwarding. The default setting blocks automatic external forwarding. Keep it that way, allow exceptions only for named mailboxes, and review existing inbox rules for forwarding or deletion rules nobody can explain.

9. DKIM and DMARC

Why: they stop others sending mail that appears to come from your domain, and they are needed for delivery to Gmail, Yahoo and Outlook.com. Where: Defender portal, Email and collaboration, Policies and rules, Threat policies, Email authentication settings, DKIM. Microsoft's guides cover configuring DKIM for your custom domain and setting up DMARC. Start DMARC at p=none, read the reports, then move to enforcement.

A sensible order of work

Changing everything at once risks locking people out. A safer order for a small tenant:

1. Create two emergency access (break-glass) accounts and store their credentials securely.
2. Turn on audit logging if it is not already on, so you can see what changes and who changes it.
3. Register every user for MFA, then enforce it through security defaults or Conditional Access.
4. Block legacy authentication once sign-in logs show nothing important still depends on it.
5. Clean up admin roles and remove unused accounts and licences.
6. Apply Defender for Office 365 policies and review external forwarding.
7. Tighten external sharing, then set up DKIM and start DMARC at p=none.

Tell users before MFA is enforced, explain how to set up the authenticator app, and have someone available on the day. Most problems are people who changed phones.

Common gaps in small tenants

• A single global administrator account used for daily email
• MFA enabled for some users but not enforced for all
• Former staff accounts still active, sometimes with licences
• Automatic forwarding to personal addresses set up years ago
• Anyone links allowed for all files and folders with no expiry
• DKIM not enabled for the custom domain, and no DMARC record

None of these needs new licences to fix. They need someone to check, decide and change the settings carefully.

Record each change as you make it: what you changed, when, why and who approved it. That record helps if something breaks, shows auditors and clients that the tenant is managed, and gives the next administrator a starting point. Recheck the list after staff changes, new licences or a move to a new plan, because defaults and available features differ between Microsoft 365 plans.

Keeping it that way

• Review Microsoft Secure Score monthly for new recommendations.
• Review admin role assignments and guest accounts every quarter.
• Check sign-in logs for blocked legacy sign-ins and unusual locations.
• Re-check settings after any licence change, because some features appear or disappear with plans.
• Have the configuration tested independently from time to time.