Microsoft 365 Security Checklist for Small Businesses
Twelve practical Microsoft 365 controls that close the gaps we find most often in SMB tenants - most of them free, all of them worth deploying this quarter.
Microsoft 365 is the operating system of most Canadian SMBs. It is also where most of the security gaps we find live - not because Microsoft 365 is insecure, but because it is secure-by-configuration, not secure-by-default. The tenants we audit in Ottawa and Toronto are usually missing the same handful of controls. Almost all of them are free with the licenses you already own.
This is the working checklist we use during a Microsoft 365 security baseline review. It is not theoretical. Every item has stopped a real incident for a real SMB.
1. Enforce MFA for every user, including service accounts
Enable multifactor authentication for 100% of your users via Conditional Access, not the legacy per-user MFA toggle. Service accounts and shared mailboxes need a plan too - either app passwords with strict scoping or, better, modern authentication with managed identities.
Roll Conditional Access policies in report-only mode for a week before enforcing. That gives you a real picture of who is using what, and prevents a Monday-morning lockout.
2. Block legacy authentication
Legacy auth protocols (IMAP, POP, SMTP AUTH, older Office clients) bypass MFA entirely. Disabling them blocks the most common password-spray and brute-force attacks against M365. Audit sign-in logs for legacy auth traffic first, then create a Conditional Access policy that blocks it.
3. Protect admin accounts properly
- Separate admin accounts from day-to-day user accounts - no admin role on the account you use for email.
- Require phishing-resistant MFA (FIDO2 keys or certificate-based) for Global Admin and Privileged Role Admin.
- Limit Global Admins to the absolute minimum - two is plenty for most SMBs.
- Enable Privileged Identity Management (PIM) if your license includes it, so admin rights are time-bound.
4. Configure Conditional Access baselines
At minimum: require MFA from any location, block sign-in from countries you do not operate in, and require compliant (Intune-managed) devices for admin roles. Microsoft's security defaults are a reasonable starting point if you are unlicensed for Conditional Access; if you have it, use it.
5. Deploy Intune for device compliance
Even at minimum: enroll Windows and macOS devices, require disk encryption, screen lock and a current OS version. Conditional Access can then require a compliant device for sensitive resources - SharePoint, finance, payroll.
6. Turn on Defender for Office 365 anti-phishing
If your license includes Defender for Office 365, enable Safe Links, Safe Attachments and anti-phishing policies with impersonation protection for your top ten most-impersonated mailboxes (typically execs and finance). Wire fraud against SMBs almost always starts with email impersonation; this single control blocks the majority of it.
7. Configure SPF, DKIM and DMARC
These three DNS records make it dramatically harder for attackers to spoof your domain in phishing campaigns against your customers and partners. Start with DMARC in p=none, monitor reports for two to four weeks, then move to quarantine and finally reject. Most SMBs never get past p=none and leave the door open.
8. Back up Microsoft 365 with a third party
Microsoft replicates the service. They do not protect you from a user deleting a SharePoint library, an attacker encrypting OneDrive, or a retention policy mistake. A third-party Microsoft 365 backup (Veeam, Datto, AvePoint, Keepit) is essential - and tested restores are the only proof it works.
10. Audit and clean up licensing
Most SMBs we audit have 10 to 25 percent of M365 spend going to dormant accounts, duplicate licenses or oversized SKUs. Run a quarterly licence audit. The savings often pay for the security work above.
11. Turn on unified audit logging
Audit logging is on by default for newer tenants but often disabled in older ones. Without it you have no forensic trail when something goes wrong. Verify it is on and that you retain logs for at least 180 days - longer if you can.
12. Document everything and review quarterly
Conditional Access policies, admin role assignments, sharing settings, DLP rules and Intune compliance baselines all drift over time. A quarterly review by a named owner catches drift before it becomes an incident. If the answer to "who owns M365 security at your company" is silence, that is the first thing to fix.
Bottom line
None of this is exotic. Most of it is included in the Business Premium SKU most SMBs already pay for. The work is in deploying it carefully, documenting it, and reviewing it every quarter. If you want a written baseline review of your tenant before you start, we run one as part of our free IT assessment.