The Microsoft 365 settings that actually matter.

A new Microsoft 365 tenant is reasonably safe out of the box, but most small-business tenants are not new. They were set up years ago, by someone who has since moved on, with settings nobody has looked at since. That is where account takeovers and fake-invoice fraud start.

This checklist covers the settings that do the most good in a tenant of 5 to 150 people. Work through it in order. Most items take a few minutes each. You need a Global Administrator account to change them.

Microsoft renames menus often. The paths below were correct in November 2026, but menu names may vary. If a path has moved, search the setting name in the admin centre's search bar.

1. Turn on multi-factor authentication for everyone

• If you have Business Basic or Standard: turn on security defaults. Go to the Microsoft Entra admin centre (entra.microsoft.com) > Identity > Overview > Properties > Manage security defaults, and set it to Enabled. This requires MFA for everyone and blocks old sign-in methods.
• If you have Business Premium (or Entra ID P1): use Conditional Access instead, under Entra admin centre > Protection > Conditional Access. Start with a policy that requires MFA for all users, one that blocks legacy authentication, and one that requires phishing-resistant MFA for admins. Turn security defaults off only once these are on.
• Ask staff to use the Microsoft Authenticator app with number matching, not text messages, wherever possible.
• Check who has not registered: Entra admin centre > Protection > Authentication methods > User registration details.

2. Clean up admin accounts

• Go to the Microsoft 365 admin centre (admin.microsoft.com) > Roles > Role assignments > Global Administrator. Keep two to four people at most.
• Admins should use a separate admin account that does not have a mailbox and is never used for everyday email or browsing.
• Create one emergency "break-glass" admin account with a long password stored offline, excluded from the policies that could lock you out. Check it signs in twice a year.
• Use smaller roles where you can: billing, user or helpdesk administrators do not need Global Admin.
• Remove accounts for people who left. Under Users > Active users, block sign-in first, then convert the mailbox to a shared mailbox if you need to keep it.

3. Block legacy authentication

Old protocols (POP, IMAP, basic SMTP AUTH) do not support MFA, so attackers use them to try stolen passwords. Security defaults and the Conditional Access policy above block them. Microsoft has been retiring basic authentication across Exchange Online, including for SMTP AUTH, so check old scanners, printers and line-of-business apps that send email. Move them to an authenticated relay or a supported method before they stop working.

4. Lock down external sharing

• SharePoint admin centre > Policies > Sharing. Set SharePoint and OneDrive to New and existing guests or stricter. Avoid "Anyone" unless you have a real need for links that work without signing in.
• On the same page, set the default link type to Specific people, and if you keep "Anyone" links, give them an expiry of 30 days or less.
• Teams admin centre > Users > External access and Guest access. Decide which outside organizations can chat with your staff, and whether guests are allowed at all.
• Review what is already shared: each site's owner can see sharing in the site's settings, and the SharePoint admin centre lists sites with external sharing turned on.

5. Stop silent email forwarding

Attackers who get into a mailbox often add a rule that copies or hides emails about payments. Close both doors:

• Automatic forwarding outside the company: Microsoft Defender portal (security.microsoft.com) > Email & collaboration > Policies & rules > Threat policies > Anti-spam > Anti-spam outbound policy. Set automatic forwarding to Off, then allow exceptions only for named mailboxes that need it.
• Existing inbox rules: in the Exchange admin centre (admin.exchange.microsoft.com) check each mailbox for forwarding under Mailboxes, and check Mail flow > Rules for company-wide rules you did not create. Look for rules that forward, delete or move messages containing words like "invoice", "payment" or "bank".
• Make sure the alert for suspicious forwarding is on: Defender portal > Email & collaboration > Policies & rules > Alert policy.

6. Defender basics

• Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset security policies. Apply Standard protection to everyone (Strict for finance and executives). This sets anti-phishing, anti-spam and anti-malware in one step, plus Safe Links and Safe Attachments if your plan includes Defender for Office 365 (Business Premium does).
• Turn on DKIM for your domain: Defender portal > Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM. Then publish SPF and a DMARC record at your DNS host.
• If you have Business Premium, onboard every laptop to Defender for Business so you can see and isolate an infected device.
• Check Microsoft Secure Score in the Defender portal (under Exposure management, menu names may vary). Treat it as a to-do list, not a grade.
• Confirm auditing is on: Microsoft Purview portal > Audit. Without it you cannot investigate a break-in afterwards.

7. Stop staff from granting apps access to company data

Entra admin centre > Identity > Applications > Enterprise applications > Consent and permissions. Set user consent to Do not allow or to verified publishers with low-risk permissions only, and turn on the admin consent workflow so staff can request an app instead. This blocks "consent phishing", where a fake app asks to read someone's mailbox.

8. Back up your Microsoft 365 data

Microsoft keeps the service running. Keeping your data recoverable is your job. The recycle bin and deleted-items folders only hold things for a limited time (deleted mailbox items: 14 days by default, extendable to 30; SharePoint and OneDrive recycle bins: 93 days), and retention policies are not the same as a backup you can restore from quickly.

• Use either Microsoft 365 Backup (Microsoft's own pay-as-you-go service) or a reputable third-party backup that covers Exchange, OneDrive, SharePoint and Teams.
• Keep the backup in an account an attacker who takes over your tenant cannot delete.
• Restore one mailbox and one folder as a test. A backup you have never restored from is a hope, not a plan.

9. Make it a routine

• Monthly: review Global Admins, new guest users, forwarding alerts and Secure Score.
• When someone leaves: block sign-in the same day, reset their password, revoke sessions, and remove their devices.
• Twice a year: test a restore, sign in with the break-glass account, and re-read this list.

Audit your tenant with AI

Paste the prompt below into ChatGPT, Claude or Copilot with your current settings described in plain words or exported from the admin centres. It tells you what to change first.

You are a Microsoft 365 security reviewer for a small business. I will describe my tenant. Tell me what to change, in priority order, with the exact admin-centre path for each change.

Business: [number of staff], [industry], [office / remote / mixed]
Licences: [e.g. Business Basic / Standard / Premium, E3]
MFA today: [security defaults on/off, Conditional Access policies, who has MFA]
Global Administrators: [how many, and whether they are separate admin accounts]
Break-glass account: [yes/no]
External sharing setting in SharePoint/OneDrive: [e.g. Anyone / New and existing guests]
Automatic forwarding outbound policy: [on / off / don't know]
Defender preset policies: [Standard / Strict / none / don't know]
DKIM, SPF, DMARC: [what is set up, or don't know]
User consent to apps: [allowed / restricted / don't know]
Devices: [Windows/Mac/phones, managed in Intune or not]
Backup of Microsoft 365 data: [describe or "none"]
Anything that sends email with an old password (scanners, apps): [list]

Give me:
1. A table: setting, what I have, what it should be, why it matters (one line), admin-centre path, effort (minutes).
2. The top 5 changes to make this week, in order, and what could break for users when I make each one (so I can warn staff).
3. A safe rollout plan for MFA if not everyone has it yet.
4. A monthly 15-minute check I can repeat.

Rules: plain language, explain any jargon in one line. Say "menu names may vary" where Microsoft has moved things recently. If something depends on my licence, say which licence. Do not recommend paid third-party products unless I ask. Canadian English.

Never paste passwords, API keys, recovery codes or customer data into an AI tool. Describe settings, not secrets.

Want it done for you?

We set up and review Microsoft 365 tenants for small businesses in Ottawa and across Canada, including MFA rollout without locking anyone out, and backups we test.