Secure Microsoft 365 for Small Business

Why a fresh Microsoft 365 tenant is exposed by default

Microsoft sells M365 to organizations of every size, from a two-person law firm to a Fortune 50 bank. Out of the box, the security posture splits the difference. The defaults are intentionally permissive so that nothing breaks during onboarding. That convenience is also the gap.

Here is what a brand-new Business Premium tenant actually does the day you finish setup. MFA is offered through Security Defaults but not enforced for every sign-in surface. Legacy authentication protocols (POP3, IMAP4, SMTP AUTH) are still reachable on tenants provisioned before 2020. SharePoint and OneDrive default to "anyone with the link" external sharing on most file types. Defender for Office 365 ships with policies set to baseline rather than the strict preset. Data Loss Prevention has zero policies. The unified audit log retains records for 90 days, then deletes them.

None of that is a bug. Microsoft documents every setting and explains how to change it. The problem is that nobody changes them. A 25-person company buys M365, sets up email, points DNS, and treats security as a future problem. Eighteen months later the bookkeeper clicks an invoice phishing link, the attacker walks in with a stolen password, and the audit log to prove what was taken expired three weeks ago.

A hardened baseline closes those gaps in a deliberate order. This guide is the deployment sequence. Once it's in place, the M365 quarterly drift-check playbook is what you run every 90 days to make sure nothing slipped.

The license you actually need: Business Premium or higher

You cannot harden M365 on Business Basic or Business Standard. Both ship with Exchange Online and the productivity suite, but neither includes the security stack you need to enforce a real baseline. The minimum tier that includes everything in this guide is Microsoft 365 Business Premium.

Business Premium bundles three things you cannot reasonably substitute: Microsoft Entra ID Premium P1 (Conditional Access, sign-in risk evaluation, Identity Protection), Microsoft Intune (device compliance and management), and Microsoft Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing tuned for impersonation). At list price the upgrade from Business Standard is roughly $10 per user per month. For a 30-seat company that is $300 a month for the controls that decide whether a credential-stuffing attack ends in a help-desk ticket or a forensic engagement.

If your seat count is above 300, you have outgrown the Business SKUs and need Microsoft 365 E3 (or E5 for the full Defender suite plus Microsoft Purview eDiscovery and the audit retention extension built in). For everyone in the 10-to-300 range, Business Premium is the correct answer.

Cyber insurance carriers have caught up to the licensing question too. Most renewal questionnaires now ask which M365 SKU you run. The full requirement list lives in the cyber insurance compliance checklist.

The seven workstreams of a complete M365 hardening

A real baseline is not five settings on one screen. It is seven independent workstreams that have to land together. Skip one and the others get routed around.

1. Identity. MFA enforcement on every account including service principals, Conditional Access policies that block legacy authentication and high-risk sign-ins, named admin accounts separated from daily-driver mailboxes, and two break-glass accounts excluded from all access-blocking policies. Settings live in Microsoft Entra admin center under Protection and Identity.

2. Email security. Defender for Office 365 set to the Strict preset, Safe Links and Safe Attachments enabled tenant-wide, anti-phishing impersonation protection configured for the C-suite, and SPF, DKIM, and DMARC records published with DMARC moved to p=quarantine within 60 days. The full settings checklist lives at the Microsoft 365 email security checklist.

3. Endpoint. Intune compliance policies that require disk encryption, current OS patches, Defender for Endpoint enrollment, and a screen-lock timer. Conditional Access then refuses tenant access from any device that fails compliance. Without this layer, a stolen laptop sitting on a coffee-shop Wi-Fi has the same access as the user.

4. Data protection and external sharing. SharePoint sharing scoped to "specific people" by default rather than "anyone with the link," DLP policies for credit card numbers and government IDs, sensitivity labels for "Confidential" and "Highly Confidential" content, and a tenant-wide block on auto-forwarding to external domains.

5. Logging and monitoring. Unified audit log retention extended from 90 days to 365, alert policies for suspicious activity (impossible-travel sign-ins, mass-download from SharePoint, mailbox forwarding rule creation), and a weekly review of the Microsoft Defender portal.

6. Backup. M365 retains your data, not your data history. A real backup means a third-party tool that snapshots Exchange, SharePoint, OneDrive, and Teams to immutable storage outside the tenant. Microsoft does not offer this and ransomware against M365 happens. Pick one of Veeam, Barracuda, or AvePoint and budget around $4 per user per month.

7. Ongoing maintenance. A quarterly drift check that compares current tenant settings to the baseline, monthly review of new admin accounts and Conditional Access exceptions, and an annual policy refresh as Microsoft retires features and adds new ones. The control that does not get checked is the control that gets disabled.

Days 1 to 7: identity controls every M365 tenant should ship with

Identity comes first because every other control assumes identity is solved. Conditional Access cannot evaluate a sign-in if MFA never fired. Defender alerts get noisy if every admin shares one mailbox.

Day 1 is inventory. Pull the full user list, the role assignments, and the current MFA enforcement state. The single PowerShell snippet below tells you which accounts have MFA registered, which have it required, and which are still open.

Connect-MgGraph -Scopes "User.Read.All", "UserAuthenticationMethod.Read.All", "Policy.Read.All"

Get-MgUser -All -Property Id, UserPrincipalName, AccountEnabled |
  ForEach-Object {
    $methods = Get-MgUserAuthenticationMethod -UserId $_.Id
    [PSCustomObject]@{
      User           = $_.UserPrincipalName
      Enabled        = $_.AccountEnabled
      MFARegistered  = ($methods.AdditionalProperties.'@odata.type' -match 'microsoftAuthenticator|fido2|phoneAuthentication').Count -gt 0
      MethodCount    = $methods.Count
    }
  } |
  Sort-Object User |
  Export-Csv mfa-state.csv -NoTypeInformation

Day 2 to 3 is enforcement. In Microsoft Entra admin center, turn off Security Defaults if it is still on (it conflicts with Conditional Access), then build the four foundational Conditional Access policies: require MFA for all users, block legacy authentication, require compliant device for admins, and block sign-ins from countries the company never operates in. Stage every policy in Report-only mode for at least 48 hours before flipping to On. The legacy-auth policy gets its own treatment in the step-by-step guide to blocking legacy authentication in Microsoft 365. Reuse that detection query before you enforce.

Day 4 is named-admin separation. Every Global Administrator should have two accounts: a daily-driver mailbox with no admin role, and a separate [email protected] account with the role and no mailbox license attached. Stop using a mailbox-bound admin account to read email. The admin account exists to do admin work, log out, and stop existing as an attack surface.

Day 5 is break-glass. Create two emergency-access accounts ([email protected], [email protected]), assign Global Administrator, give each a 64-character password stored in two physically separate vaults (one on paper in a safe, one in a password manager), exclude both from every Conditional Access policy, and never sign in to them except in a real emergency. Microsoft documents the pattern. Small businesses skip it because it feels paranoid until the day a misconfigured CA policy locks every other admin out.

Day 6 is privileged role audit. List every account holding a Global Administrator, Privileged Role Administrator, or Exchange Administrator role:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"

$privilegedRoles = "Global Administrator","Privileged Role Administrator",
                   "Exchange Administrator","SharePoint Administrator",
                   "Security Administrator","User Administrator"

Get-MgRoleManagementDirectoryRoleAssignment -All |
  ForEach-Object {
    $role = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId
    if ($privilegedRoles -contains $role.DisplayName) {
      $principal = Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue
      [PSCustomObject]@{
        Role  = $role.DisplayName
        User  = $principal.UserPrincipalName
        Id    = $_.PrincipalId
      }
    }
  } |
  Sort-Object Role, User |
  Format-Table -AutoSize

Two Global Administrators is the right answer for a 30-person company: the owner and a deputy. Anything beyond that is over-privileged unless you are running Privileged Identity Management with just-in-time elevation, which you probably are not at this size.

Day 7 is verification. Re-run the MFA query, confirm every user is registered, and confirm the four Conditional Access policies are On with the break-glass exclusion group attached. Sign-in failures should now show "blocked by Conditional Access" for any legacy-auth attempt. Move on only when that report is clean.

Days 8 to 14: email security and Defender for Office 365 hardening

Email is where 90 percent of small-business breaches start. The good news: Defender for Office 365 P1 ships with Microsoft Business Premium, and Microsoft now publishes a Strict preset that does most of the configuration in one click. The trap is assuming the preset is enough on its own.

Day 8 is the preset. In the Microsoft Defender portal, go to Email and collaboration, then Policies and rules, then Preset security policies. Apply the Strict preset to all users for both anti-phishing and anti-malware. The preset enables Safe Links scanning at click time, Safe Attachments dynamic detonation, and zero-hour auto-purge for messages that turn out to be malicious after delivery.

Day 9 is impersonation protection. Defender knows the difference between a real CEO email and a lookalike when you tell it who the CEO is. In the anti-phishing policy, add the C-suite (CEO, CFO, COO, owner, controller) as protected users and add the company’s primary domain as a protected domain. This stops the most common BEC pattern: an attacker registers yourcompany-llc.com and emails accounting pretending to be the owner.

Day 10 is SPF, DKIM, and DMARC. These are DNS records that prove email claiming to come from your domain actually came from your tenant. SPF should list every legitimate sender (M365, plus any marketing platform). DKIM signing is a one-click enable per accepted domain. DMARC starts at p=none with reporting on, then graduates to p=quarantine once the reports are clean. Most small businesses stop at p=none, which is the equivalent of a security camera that records nothing.

Day 11 is auto-forwarding. Block external auto-forwarding at the tenant level. Most mailbox compromises end with the attacker setting an inbox rule that forwards every email containing "wire" or "invoice" to a Gmail address they control. Disable this in Exchange admin center under Mail flow, then Remote domains, by setting the default remote domain’s "Automatic forwarding" to Disabled. If a specific user genuinely needs forwarding, carve out a single allowed remote domain rather than leaving the global door open.

Day 12 is connection filtering and the IP allow list. If you have a bookkeeping platform or alerting service that sends mail through M365, list its IPs in the connection filter policy. Anything else gets the default scoring.

Day 13 is alerting. In Microsoft Purview compliance portal, enable the alert policies for "Suspicious email forwarding activity," "Phishing campaign detected," and "User restricted from sending email." Route alerts to a shared inbox the owner actually monitors, not a dead distribution list.

Day 14 is verification. Send a test phishing-style message from a personal Gmail to your tenant pretending to be the owner. Defender should flag it as impersonation. If it lands in the inbox clean, the impersonation rules are not active and the rollout is not done.

Days 15 to 21: endpoint compliance and Intune rollout

Identity tells you who is signing in. Endpoint compliance tells you what they are signing in from. Without both, an attacker with a stolen password and an unmanaged laptop has the same access as a legitimate employee on a company-issued, fully patched device. Intune closes that gap.

Day 15 is enrollment. Every Windows laptop, Mac, and company-issued mobile device needs to enroll in Intune. For Windows 11, the cleanest path is Autopilot: a new device boots, the user signs in with their M365 credentials, and Intune pushes policies before the desktop loads. For existing fleet, push enrollment via Group Policy on AD-joined machines or via the Company Portal app on machines that are not domain-joined.

Day 16 is the compliance policy. Build one Windows compliance policy and one macOS policy with these requirements: BitLocker (or FileVault) enabled, OS at the supported version or newer, antivirus on with current signatures, screen-lock timer set to 15 minutes, and password complexity enforced. Devices that fail any check show as "Not compliant" in the Intune dashboard.

Day 17 is the Conditional Access tie-in. Edit your existing CA policies to add the grant control "Require device to be marked as compliant." Now a non-compliant device cannot reach Exchange, SharePoint, or Teams regardless of MFA status.

Day 18 is configuration profiles. Push baseline configuration: BitLocker enforcement, Microsoft Defender for Endpoint onboarding, Windows Update for Business rings (so devices patch within 14 days of release), and a Local Administrator password solution (LAPS) so every machine has a unique local-admin password rather than a shared one taped under the laptop.

Day 19 is mobile. Apply app-protection policies (the Intune feature formerly called MAM) to Outlook, Teams, OneDrive, and the Microsoft 365 mobile apps. App-protection requires a PIN to open Outlook on a phone, blocks copy-paste from corporate to personal apps, and triggers a remote wipe of corporate data without touching the user’s personal photos. This is the right control for BYOD phones. Full device enrollment is overkill on a personal device.

Day 20 is the holdout list. Some devices will not enroll cleanly: a 7-year-old Mac running an unsupported macOS, a Windows 7 machine running a single line-of-business app, a Linux workstation. Inventory them, decide whether to retire, isolate, or carve a documented exception, and set a calendar reminder to revisit each one in 90 days.

Day 21 is verification. Sign in to a non-compliant device on purpose. The sign-in should be blocked at the Conditional Access layer with a clear "Your device is not compliant" message. If the sign-in succeeds, the policy is misconfigured. Fix it before moving to data protection.

Days 22 to 30: data protection, sharing controls, and monitoring

The last week is the one where small businesses tap out. Identity, email, and endpoint feel concrete. Sharing rules, sensitivity labels, and audit retention feel abstract until the day a former employee downloads the customer list on the way out the door.

Day 22 is SharePoint and OneDrive sharing. In the SharePoint admin center, set external sharing to "New and existing guests" rather than "Anyone." Set the default link type to "Specific people." Set the default link permission to "View" rather than "Edit." Restrict sharing to verified domains where the relationship is known. These four toggles cut accidental over-sharing more than any DLP policy will.

Day 23 is DLP. In Microsoft Purview, build two DLP policies. The first uses the built-in "U.S. Financial Data" template to block external sharing of credit card numbers and bank routing numbers. The second uses "U.S. PII" for Social Security and driver license numbers. Start each in "Test with notifications" mode for one week, watch the report, then move to "Block."

Day 24 is sensitivity labels. Build three labels: Public, Internal, and Confidential. Configure the Confidential label to encrypt the file, restrict it to "your domain only," and add a watermark. Publish the label to all users via a label policy. Most employees will never use them. The senior team will, and the encryption applies even when the file leaves the tenant.

Day 25 is audit retention. By default, the unified audit log keeps 90 days of records. Forensics on a small-business breach often takes 60 to 120 days from the first sign of compromise to the conclusion. Ninety days is the wrong number. In Microsoft Purview, create an audit log retention policy that holds Exchange, SharePoint, and Entra ID sign-in records for 365 days. Business Premium includes this; older licenses may require an add-on.

Day 26 is alerting. Go beyond the email alerts you set on day 13. In the Defender portal, enable alerts for: mailbox forwarding rule creation, eDiscovery search activity by a non-admin, mass file deletion in SharePoint, and elevation of role beyond a normal threshold. Each alert needs a named owner and a documented response.

Day 27 is the third-party backup. Sign up for a backup vendor (Veeam Microsoft 365, Barracuda, or AvePoint), point it at the tenant, and run the first full backup. Do not skip this. Microsoft does not back up your data against ransomware or against your own admin deleting a SharePoint site by mistake. The first restore test happens on day 28.

Day 28 is the restore test. Pick a single OneDrive file and a single SharePoint document library. Restore each from the backup vendor. Confirm the timestamps and content match. A backup that has never been restored is a hope, not a backup.

Day 29 is the documentation pass. Write down what was deployed, where the break-glass credentials live, who owns each alert, and what the recovery sequence looks like if the tenant gets compromised. The right format is a one-page operations runbook, not a 40-page Word document. Store it in a known location that does not depend on the tenant being available.

Day 30 is the baseline lock. Run the audit one more time, fix anything that drifted during the rollout, and snapshot the configuration. Compare the snapshot to the CIS M365 Benchmark checklist for small business and decide which Level 2 items, if any, you want to layer in next quarter.

Five controls that always get skipped on DIY rollouts (and shouldn’t)

The deployment above covers the items that show up on most checklists. Five more rarely make it into a DIY rollout, and they are the ones that turn a recoverable incident into an unrecoverable one.

• Named admin and break-glass separation. Day 4 and Day 5 above. Most small-business tenants have one Global Administrator, and that account is also the owner’s daily mailbox. When the owner’s mailbox gets phished, the attacker inherits the keys to the kingdom. Two break-glass accounts plus separated daily-driver mailboxes is not optional.
• Session revocation policy. When you suspect a credential is compromised, you reset the password. The attacker still has a valid refresh token good for up to 90 days. Run Revoke-MgUserSignInSession as part of the playbook so the session dies with the password change.
• Audit log retention extension to one year. Day 25. The default 90-day window is shorter than the average breach detection time for a small business. Cyber insurance carriers increasingly ask whether you retain audit logs for 12 months; the answer should be yes.
• Sensitivity labels for Confidential. Day 24. A SharePoint sharing setting protects the file inside your tenant. A sensitivity label with encryption protects the file after it leaves. The two are not interchangeable.
• Tenant-wide forwarding-rule restriction. Day 11. The single most common post-compromise behavior is an attacker setting a mail forwarding rule to a Gmail address. Block external auto-forwarding at the tenant level and the attack pattern stops working before you notice the password breach.

None of those five takes more than an hour. All five are usually missing. Fix them and you remove the most common reasons a small-business breach turns into a full-tenant rebuild.

After go-live: keeping the baseline from drifting

A clean tenant on day 30 is not a clean tenant on day 120. New employees get hired, new vendors ask for sharing exceptions, Microsoft retires a setting and adds three new ones, an admin disables a Conditional Access policy "for ten minutes" to troubleshoot something and forgets to turn it back on. Drift is the rule, not the exception.

The maintenance pattern that holds up is a quarterly drift check plus monthly spot reviews. Once a quarter, run the same audit queries from this guide and compare the output to your day-30 snapshot. Anything that changed without a documented reason is a finding. Once a month, review new admin accounts, new Conditional Access exceptions, new app registrations, and recent role assignments. The right amount of time for a 30-person company is about four hours a quarter and one hour a month.

Watch four signals that mean the baseline is slipping: new Global Administrators added without a ticket, Conditional Access policies moved from On to Report-only, new mailbox forwarding rules created in user inboxes, and DLP policies switched back from Block to Test mode. Each is benign individually and dangerous as a pattern.

Re-evaluate the full baseline once a year. Microsoft changes the M365 security surface aggressively; a configuration that was current in 2025 has retired settings and missing new ones by 2027. The annual refresh is also when you decide whether to layer in CIS Level 2, sensitivity-label-driven encryption for HR data, or Defender for Office 365 P2. Most small businesses stay at the Business Premium baseline; some grow into the next tier as headcount or compliance pressure climbs.

Common questions

Can a small business actually run this baseline in-house, or do we need a managed provider?

Both work. Roughly half the 10-to-50-person companies we see run a hardened M365 tenant with one internal IT generalist who spends 8 to 12 hours a month on it after the initial 30-day rollout. The other half hand the work to a managed provider because the IT generalist is also the help desk, the network admin, and the printer technician. The honest comparison is in managed M365 security vs DIY. The right answer depends on whether your in-house person has the calendar room.

We are on Business Standard. Can we still complete most of this?

No, and the gap is meaningful. Business Standard does not include Defender for Office 365 (so no Safe Links, no Safe Attachments, no impersonation protection), does not include Intune (so no device compliance enforcement), and does not include Entra ID Premium P1 (so no Conditional Access, no sign-in risk evaluation). You can deploy MFA, configure SharePoint sharing, and set basic DLP, but the rest of the baseline literally requires Business Premium. Upgrade.

Does this overlap with the CIS Microsoft 365 Benchmark?

Heavily. The 30-day baseline above corresponds to roughly the Level 1 controls of CIS Microsoft 365 Benchmark v3 (with a few Level 2 items pulled forward, like the audit retention extension and named-admin separation). If your auditor or insurer is asking specifically for CIS alignment, work the deployment from this guide and then map it to the benchmark using the CIS M365 Benchmark checklist.

What breaks during the rollout?

A predictable list. Old phones with stock mail apps stop syncing when legacy auth gets blocked (fix: install Outlook Mobile). Multifunction printers that send scan-to-email via SMTP AUTH stop sending (fix: switch to SMTP relay with IP allow-listing or move to a Microsoft Graph-based sender). Personal laptops that were syncing OneDrive without enrollment lose access until enrolled or until app-protection policies cover them. Plan on one to three help-desk tickets per fifty seats, mostly resolved in the first 72 hours after each cutover.

How often should we redo the audit after the initial rollout?

Quarterly drift checks against the day-30 snapshot, monthly review of new admin accounts and Conditional Access exceptions, and a full baseline refresh once a year. If a major incident happens at a peer company, run an out-of-cycle check on whatever vector caused it. The schedule is consistent across small-business tenants we work with and matches what most cyber insurance renewal questionnaires ask for.