Microsoft 365 Security Baseline: The Settings Every Small Business Should Review

A new Microsoft 365 tenant works on day one, but the default settings weren't written with your business in mind. A good baseline ties identity, email, sharing, devices, and admin access to how your people really work, and then gets written down so someone can check it later.

Start With Administrative Access

Admin accounts can change security settings and read business data, so they get the tightest controls.

• Give each administrator a separate, named admin account.
• Do daily email and web browsing on a normal user account, never the admin one.
• Require strong MFA for every admin sign-in.
• Remove admin roles nobody uses, and don't leave people holding privileges they need once a quarter.
• Set up emergency access accounts with written rules for when they may be used, and keep the credentials somewhere safe.

Check who holds admin roles on a schedule, and again whenever someone changes jobs.

Tighten Sign-In Controls

Require modern authentication and block the older sign-in methods that can't support current protections. Then look at:

• How many users are actually registered for MFA, and how many are forced to use it
• Risky, unfamiliar, or legacy sign-in activity
• Rules for unmanaged devices and unusual locations
• Session controls for sensitive roles
• How passwords get reset, and how your help desk confirms who is calling

Which controls you can switch on depends on your Microsoft licences. Confirm the design against your own tenant before you copy a checklist from the internet, this one included.

Review Email Protection

Email is how most of your staff talk to the outside world, and it's where most fraud shows up.

• Check your anti-phishing, anti-spam, and malware policies.
• Protect the people and domains most likely to be impersonated, usually the owner and whoever approves payments.
• Look for automatic forwarding and odd inbox rules.
• Set up SPF, DKIM, and DMARC for every domain you send from.
• Give staff an obvious way to report a suspicious message.

A report button only helps if someone reads what comes in. Decide who that is.

Control External Sharing

SharePoint, OneDrive, and Teams make it easy to share. They make it just as easy to share too much.

• Decide whether you really need anonymous links.
• Put expiry dates and sensible permissions on the links you do allow.
• Review guest users and external Teams members.
• Limit sharing on sensitive sites such as HR and finance.
• Give every shared workspace an owner.

When the project or the contract ends, remove the guests and links with it.

Protect Devices and Applications

Sign-in controls are stronger when you can see the health of the device behind them. Check that company devices have a supported operating system with current patches, disk encryption, endpoint protection that someone actually watches, screen lock, and no local admin rights for regular users. You also want a defined process for enrolling, offboarding, and remotely wiping a device.

Look at third-party app consent too. An employee who clicks "Accept" on a random add-in can leave behind lasting access to mail or files.

Turn On Useful Logging and Alerts

The people responsible for security need to see important events and know what to do about them. Start with alerts for changes to privileged roles, suspicious sign-ins, new mail forwarding rules, unusual application consent, changes to security policies, and large or unexpected sharing activity.

Write down who owns each alert, who they escalate to, and how fast a response is expected.

Keep It Going

Record the settings you approved, the exceptions you granted, who owns each one, and when you'll look again. Re-check after a licence change, a merger, a new application, or a big change in how people work.

You won't finish hardening a tenant and then walk away. The written baseline is what lets you spot drift while it's still a small fix.

Related Reading

Configuration and recovery are different problems. Our Microsoft 365 backup guide covers the second one, and you need both.