Microsoft 365 Security Best Practices

One of the more useful conversations to have with a small business is this: you are probably already paying for security capability you have not turned on.

Microsoft 365 includes a substantial amount of it. What it does not do is configure that capability for you. A tenant created by signing up online starts with settings chosen for the widest possible compatibility, which is a different objective from protecting your business.

Below are the areas we review most often, roughly in order of impact. Exact menu locations shift as Microsoft updates its admin portals, so treat the names as a guide and the intent as the point.

1. Multi-factor authentication on every account

Start here. Every account, no exceptions, and administrative accounts first.

Prefer authenticator apps over SMS, and enable number-matching if your configuration uses push approvals — plain approve/deny prompts can be defeated by sending repeated requests until someone taps approve out of fatigue.

Pay particular attention to accounts that are easy to forget: shared mailboxes with sign-in enabled, service accounts, and the original global administrator account created when the tenant was set up, which is often still active with a password nobody has changed.

2. Conditional access policies

Conditional access is where Microsoft 365 becomes genuinely capable, and it is the feature small businesses most often leave unused.

Rather than applying the same rules to everyone always, policies evaluate context — who is signing in, from what device, from where, and how risky it looks — then decide what is required.

Policies worth considering: require MFA for all users, with tighter conditions for administrators; block sign-in from countries where you have no staff or clients; require compliant or managed devices for access to sensitive data; and block legacy authentication protocols outright, since they predate MFA and provide a way around it.

That last one matters more than it sounds. Legacy protocols are a common bypass, and blocking them closes a door that many tenants leave open.

3. Administrative roles

Global Administrator is the most over-assigned role in Microsoft 365. It is frequently granted because it was the quickest way to unblock someone, and then never revisited.

Three practical steps. Review who holds global administrator rights today and reduce it to as few people as genuinely need it. Use the more specific roles — there are separate roles for user management, Exchange, SharePoint, security and compliance — rather than defaulting to full access. And keep administrative accounts separate from everyday accounts: administrators should not read email and browse the web while signed in as an administrator.

4. Mail flow rules and forwarding

This is one of the highest-value checks, because it is a signature of an active compromise.

When an attacker gains access to a mailbox, one of the first things they commonly do is create a rule that forwards mail externally, or quietly moves messages matching certain keywords — “invoice”, “payment”, “bank” — into an obscure folder so the real user does not notice the conversation happening under their name.

Review external forwarding across the tenant, and disable automatic external forwarding unless there is a documented business reason. Audit inbox rules on user mailboxes. Set up alerting for new forwarding rules being created.

Also configure external sender identification, so messages from outside the organization are visibly marked. It is a small change that helps people notice impersonation attempts.

5. Email authentication: SPF, DKIM and DMARC

These three DNS records determine how hard it is for someone to send email that appears to come from your domain. Many small business domains still have them incomplete or missing.

SPF lists which servers are allowed to send on your behalf. DKIM cryptographically signs your outbound mail. DMARC tells receiving servers what to do with messages that fail those checks, and can report back on attempted abuse.

DMARC in particular should be introduced gradually — start in monitoring mode, review the reports to catch legitimate senders you had forgotten about, then tighten the policy. Moving straight to a strict policy is a reliable way to make your own invoices stop arriving.

6. Sharing defaults in SharePoint and OneDrive

Default sharing settings are generally permissive, because Microsoft optimizes for collaboration working smoothly out of the box.

Worth reviewing: whether anyone can create links that work for anyone with the URL, no sign-in required; whether external sharing is allowed and to whom; whether sharing links expire; and what the default permission is when someone shares — edit or view.

The aim is not to prevent sharing. It is to make the easy default a safe one, so a link shared quickly does not turn into a document indexed publicly.

7. Retention and deletion

Two related things, often confused.

Retention policies determine how long data is kept and when it is removed — important both for recovering data and for not holding information longer than you should.

Litigation hold or equivalent preserves mailbox content even when a user deletes it, which matters for departing employees. When someone leaves, the standard sequence is worth documenting: block sign-in, reset credentials, revoke sessions, place the mailbox on hold, convert to a shared mailbox if colleagues still need access, and only then remove the license.

And to repeat a point worth repeating: retention is not backup. It has limits and it expires. A separate Microsoft 365 backup gives you a recovery point you control.

8. Audit logging

Audit logging records who did what and when. Without it, investigating a suspected compromise becomes guesswork.

Confirm unified audit logging is enabled, understand how long your license tier retains it, and set up alerts for events worth knowing about immediately — new global administrators, new external forwarding rules, unusual volumes of file downloads, sign-ins from unexpected locations.

The retention period is the detail people miss. Intrusions are often discovered weeks after they began. If your logs only go back thirty days, the beginning of the incident may be gone.

9. Guest and external access

Guest accounts accumulate quietly. A contractor added for a project, a client invited to a Teams channel, a supplier given access to a document library.

Review guest accounts periodically and remove those no longer needed. Set expectations about who can invite guests, and consider expiry so access does not persist indefinitely by default.

10. Review the security recommendations already in your tenant

Microsoft 365 includes a security score and a set of recommended actions specific to your configuration. It is genuinely useful as a starting inventory of what is not enabled.

Two caveats. Not every recommendation suits every business, and some carry operational trade-offs worth weighing rather than accepting blindly. And a score is a measure of configuration, not of safety — a good score with no monitoring and no backups is not a secure environment.

Where to begin

If this list feels long, the order that delivers the most protection soonest is: MFA everywhere including administrators, block legacy authentication, review who holds global administrator rights, check for unexpected mail forwarding rules, and confirm audit logging is on with the longest retention your license allows.

Those five can typically be done in an afternoon and close the gaps that most commonly matter. The rest is worth working through methodically afterwards — and worth reviewing again periodically, because tenants drift as businesses change.

---

This article is general guidance and is not legal, regulatory or compliance advice. Technology and threats change — if you are making a decision based on it, check that it still reflects your current environment.