The Microsoft 365 settings that matter most.
Every item below is checkable in the Microsoft 365 admin centre in an afternoon. No licences to buy first - most of it ships with the plan you already pay for.
Identity and admin
Most Microsoft 365 break-ins are sign-ins, not exploits. These settings decide whether a stolen password is a bad day or a non-event.
- ✓MFA is required for every user - via Security Defaults or Conditional Access, with no “we’ll get to it” exceptions
- ✓Global admin is limited to two to four accounts, each a dedicated admin account nobody reads mail from
- ✓Legacy authentication (IMAP, POP, SMTP basic auth) is blocked - it bypasses MFA entirely
- ✓Every admin and every mailbox belongs to a named person; shared mailboxes have no sign-in enabled
- ✓Offboarding disables the account, revokes sessions and converts the mailbox - the same day
Email and data flow
The settings that stop your domain being used against you and your data walking out quietly.
- ✓SPF, DKIM and DMARC are configured for your domain - and DMARC is enforced, not just monitoring
- ✓External senders are visibly tagged, so a spoofed “internal” email looks wrong at a glance
- ✓Automatic forwarding to external addresses is disabled or alerts an admin - a classic compromise sign is a quiet forwarding rule
- ✓Mailbox rules are reviewed after any suspicious sign-in - attackers hide rules that delete or divert replies
- ✓Sharing links default to “specific people”, not “anyone with the link”, and guest access gets reviewed on a schedule
Visibility and recovery
When something does go wrong, these decide whether you can see it and undo it.
- ✓Unified audit logging is turned on - it is the difference between knowing and guessing after an incident
- ✓Sign-in risk and new-device alerts reach a mailbox somebody actually reads
- ✓OneDrive and SharePoint versioning and recycle-bin retention are left at defaults or better - they are your first ransomware undo
- ✓Microsoft 365 data is in your backup plan - the built-in retention windows are not a backup
- ✓Somebody has actually restored a file, a mailbox item and a deleted account before it mattered
Related tools and next steps
Score your posture
Check your Microsoft 365 basics against the controls that decide real risk.
Try the scorecardSecurity checklist
The wider set of small-office basics, in plain English.
Open the checklistAccess and MFA review
A focused review of admin accounts, MFA, and offboarding. From $600.
Review access and MFAReady to see where you stand?
Start with a baseline security checkup. We review your environment, score the highest-risk gaps, and hand you a plain-English 30-day plan.