Microsoft 365 security checklist for small and mid-sized businesses

Microsoft 365 security is not a single toggle. Identity, email, collaboration, applications and endpoints all contribute to the tenant’s risk.

1. Verify MFA coverage

Confirm which users and administrators are protected, which authentication methods are allowed and which accounts are excluded. Do not assume that “MFA is enabled” means every intended identity is covered.

2. Review Conditional Access

Document each policy, target population, exclusions and dependencies. Pay special attention to emergency access accounts, service accounts, guests and device-based conditions.

3. Reduce privileged access

• Review Global Administrator assignments.
• Use separate administrative identities where appropriate.
• Remove stale privileged roles.
• Review role activation and standing privilege.

4. Check stale users and offboarding

Compare active accounts with the current workforce. Review disabled users, former employees, contractors, shared mailboxes and application access. Offboarding should cover both Microsoft 365 and connected SaaS services.

5. Harden email security

Review anti-phishing policies, impersonation protection, attachment/link controls available in the tenant, mailbox forwarding and suspicious inbox rules. Also verify SPF, DKIM and DMARC for business domains.

6. Review external sharing

Understand how SharePoint, OneDrive and Teams can share information outside the organization. Check guest expiration, anonymous links and sites containing sensitive information.

7. Review enterprise applications

Third-party SaaS integrations can hold powerful delegated or application permissions. Inventory enterprise applications, publishers, consent grants and unused integrations.

8. Connect device posture to access

If Intune or another endpoint-management platform is available, determine whether device compliance and management state influence access to sensitive cloud resources. Review encryption, supported OS versions, EDR and screen-lock requirements.

9. Review logging and investigation capability

Know which audit logs are available under the organization’s licensing, how long relevant data is retained and who responds to suspicious sign-ins, mailbox activity or privilege changes.

10. Measure coverage continuously

A one-time assessment is useful, but users, devices and applications change. Track meaningful metrics such as MFA coverage, unmanaged access, privileged identities, stale accounts and security-control exceptions.