Microsoft 365 includes powerful security controls, but many tenants never switch them on. Use this checklist to review your setup. Some items depend on your licence (for example, Business Premium or E3/E5), so treat it as a guide rather than a rigid standard.
Identity and access
- MFA enforced for all users, with phishing-resistant methods for administrators
- Legacy authentication blocked
- Conditional access policies for risky sign-ins, locations and unmanaged devices
- Separate, minimal global administrator accounts plus documented break-glass accounts
- Guest access and external collaboration reviewed regularly
Email protection
- SPF, DKIM and DMARC configured, with DMARC moving towards enforcement
- Anti-phishing, Safe Links and Safe Attachments policies enabled where licensed
- Automatic external forwarding blocked
- Users can easily report suspicious messages
Data and sharing
- SharePoint and OneDrive external sharing limited to what the business needs
- Sensitivity labels defined for confidential and restricted data
- Data loss prevention policies for personal and financial data
- Retention policies aligned to legal and business needs
Devices
- Devices enrolled in Intune with compliance policies (encryption, updates, screen lock)
- Endpoint protection deployed and reporting on every device
- Access from non-compliant devices restricted
Monitoring and recovery
- Unified audit logging enabled and reviewed
- Alerts for risky sign-ins and admin changes routed to someone who will act
- Independent backup of Exchange Online, SharePoint, OneDrive and Teams considered
- Secure Score reviewed monthly with an improvement plan
Want this done for you? Our Microsoft 365 security service assesses your tenant and implements these controls in a planned, low-disruption way. Learn more.
