Home > Microsoft 365 and email > Microsoft 365 security
Microsoft 365 security checklist for small business
Microsoft 365 comes with strong security tools, but many of them are off or half set up in small business accounts. Business email compromise, where a scammer gets into a mailbox and quietly watches for invoices and payments, is one of the costliest crimes reported to the FBI. Here is the checklist we use to lock it down.
The short answer
- Turn on multi factor sign in (MFA) for every account, owners and admins first.
- Block old sign in methods that skip MFA.
- Set up SPF, DKIM and DMARC so scammers cannot send email as your domain, and so your own mail gets delivered.
- Get alerts when someone creates a mailbox rule that forwards or hides email, a classic sign of a break in.
- Back up mailboxes and files separately. Microsoft keeps your data running, but it is not a full backup.
The checklist
| Setting | Why it matters |
|---|---|
| MFA for all users | Stops most account takeovers from stolen passwords. See MFA explained |
| Security defaults or Conditional Access | Security defaults are free. Business Premium adds Conditional Access for finer control |
| Legacy sign in blocked | Old email apps and protocols can skip MFA |
| Separate admin accounts | Daily work is never done in a global admin account |
| SPF, DKIM and DMARC | Proves your mail is real and blocks look-alike senders using your domain |
| External forwarding blocked | Stops a hijacked mailbox from copying mail to an attacker |
| Alerts for new inbox rules and risky sign ins | Catches a break in while it is happening |
| Safe links and attachments | Checks links and files before staff open them (Defender for Office 365) |
| Sharing limits | OneDrive and SharePoint files not shared with "anyone with the link" by default |
| Offboarding steps | Former staff blocked the day they leave, mailbox converted or kept as needed |
| Separate backup | Restores deleted or encrypted mail and files beyond Microsoft's retention |
Signs a mailbox was taken over
If you think a mailbox was hacked
- Reset the password and sign the user out of all sessions.
- Turn on MFA if it was off, and remove any MFA methods you do not recognize.
- Delete unknown inbox rules and forwarding.
- Check sent mail and warn anyone who received fake invoices or payment changes.
- If money was sent, call the bank immediately and report it at ic3.gov.
How WENO secures your Microsoft 365
Questions people ask
Is MFA annoying for staff?
It takes a few seconds, and with the Microsoft Authenticator app most sign ins are a single tap. Remembered devices mean fewer prompts.
Do we need Business Premium?
Not always. Security defaults on any plan cover the basics. Business Premium adds Conditional Access, device management and stronger email protection, which many insurers like to see.
Doesn't Microsoft back up our email?
Microsoft keeps the service running and holds deleted items for a limited time. A separate backup lets you restore older or encrypted data on your schedule.
Sources
- Microsoft: Security defaults
- Microsoft: Email authentication (SPF, DKIM, DMARC)
- FBI Internet Crime Complaint Center
General information. Features vary by Microsoft 365 plan.