Is Your Microsoft 365 Really Secure? 15 Settings to Check Today.

Why a checklist matters

Microsoft 365 ships with sensible defaults, but many of the strongest protections need to be switched on, licensed correctly, or configured for how your business works. A tenant that was set up quickly in 2019 and never reviewed is a common finding in our assessments.

The good news: most of the steps below take minutes, and several are free with the licences you already own. Check your current posture first with Microsoft Secure Score in the Microsoft Defender portal, then work through the list.

Identity and sign-in (items 1–6)

1. Require MFA for everyone. Admins first, then all users. Prefer the Microsoft Authenticator app or passkeys over SMS.
2. Block legacy authentication. Old protocols (POP, IMAP, SMTP AUTH) can't do MFA and are a favourite target.
3. Use Conditional Access. Require MFA, block risky countries you never operate in, and require compliant devices for sensitive apps.
4. Separate admin accounts. Admins should use a dedicated account for admin work, never their daily mailbox.
5. Limit Global Administrators. Keep it to a small handful and use least-privilege roles for everything else.
6. Create two break-glass accounts. Emergency accounts with long passwords, excluded from Conditional Access, stored offline and monitored.

Email and phishing protection (items 7–10)

7. Publish SPF, DKIM and DMARC. They stop criminals from sending email that pretends to be your domain. Move DMARC from none to quarantine or reject once you've confirmed legitimate senders.
8. Turn on Defender for Office 365 policies. Safe Links and Safe Attachments check URLs and files at click-time (licence-dependent).
9. Disable automatic external forwarding. Attackers often add a hidden inbox rule that forwards your email to themselves.
10. Review inbox rules and mailbox permissions. Unknown rules or "full access" grants are a red flag.

Data, devices and apps (items 11–13)

11. Restrict user consent to third-party apps. Malicious "Sign in with Microsoft" apps can read email without a password.
12. Enrol devices in Intune and require compliance. Encryption, a screen lock and up-to-date OS, before data syncs to the device.
13. Review guest and external sharing. Remove stale guests and set SharePoint sharing to the least permissive level your teams can work with.

Visibility and recovery (items 14–15)

14. Enable unified audit logging and alerts. If something goes wrong, logs are how you learn what was touched.
15. Back up Microsoft 365 independently. Retention is not backup. A third-party backup lets you restore after ransomware, accidental deletion or a malicious insider.

A note on Canadian privacy

If you handle personal information, PIPEDA (and Quebec's Law 25, if you serve Quebec residents) expects reasonable safeguards. Documenting these 15 controls is a practical way to show you have them. Related reading: Zero Trust for small business and our cybersecurity services.