A sensible Microsoft 365 security baseline for a small business

Start with your licence, because it decides what exists

Microsoft groups Business Basic, Business Standard and Business Premium as Microsoft 365 for business, aimed at organisations of up to 300 users. They share a security foundation but differ in what sits on top, so check which subscriptions you hold before hunting for a setting your tenant does not have.

This baseline covers identity, email and monitoring only. Device management, SharePoint sharing, backup and Teams are separate jobs. Where we say a check is read-only, you can look without changing anything, and a Global Reader or Security Reader role is enough for many of those views. You do not need a Global Administrator account for the survey.

• All three tiers: Microsoft Entra ID Free (which includes security defaults) and built-in protection for cloud mailboxes - anti-malware, anti-spam and spoofing protection in anti-phishing policies.
• Business Premium adds Microsoft Entra ID P1 (which brings Conditional Access) and Microsoft Defender for Office 365 Plan 1 (Safe Links, Safe Attachments and impersonation protection).
• Microsoft Defender Suite for Business Premium is a separate purchase that adds Entra ID P2 and Defender for Office 365 Plan 2. Nothing in this baseline needs it.

Identity: find out how multifactor authentication is actually enforced

A stolen or guessed password is still the most ordinary way into a mailbox, and multifactor authentication (MFA) is the control that stops a password on its own being enough. The NCSC's advice for small organisations is to use passkeys on business-critical accounts where they are available and otherwise to use 2-step verification, adding that any type is better than none. If you are working towards Cyber Essentials, its current requirements treat MFA on cloud services as mandatory where it is available.

In Microsoft 365 there are three ways MFA can be enforced, and you need to know which one you are on. Security defaults are a fixed on-or-off set of rules included with every tier. Conditional Access policies (Business Premium) are the customisable replacement. Legacy per-user MFA is the old method, and Microsoft marks it not recommended. You cannot run security defaults and Conditional Access together: if any Conditional Access policy exists, even one switched off or in report-only mode, security defaults cannot be turned on.

1. Sign in to the Microsoft Entra admin center, go to Entra ID, then Overview, then Properties, and select Manage security defaults. Note whether the setting is Enabled or Disabled. Do not change it yet.
2. If you hold Business Premium, open the Conditional Access area of the same admin centre and list the policies and their states. If security defaults are off and there are no Conditional Access policies, nothing is enforcing MFA at the tenant level, and that is your first priority.
3. Look for per-user MFA. Users showing Enabled or Enforced on the per-user MFA page mean the legacy method is in play, and it overrides the other two. Users showing Disabled is normal when security defaults or Conditional Access are doing the work.
4. Before you enable security defaults on a tenant that does not have them, list anything old that signs in with a username and password over IMAP, POP3 or SMTP, such as scanners and older mail apps. Security defaults block legacy authentication and device code flow, so those devices will stop working, and the change makes every user register for MFA. Enable it in a quiet period and tell staff first.
5. Prove it with a test: in a private browser window, sign in as an ordinary non-admin user. You should be asked to register for, or approve, a second verification step. If you are only asked for a password, MFA is not being enforced for that account.

Identity: tidy the admin accounts

Admin accounts are the ones an attacker most wants. Microsoft's guidance is to keep their number small, give people the least powerful role that does the job (a User Administrator rather than a Global Administrator for creating accounts), and keep admin work on separate accounts from daily email and browsing. The NCSC makes the same point for devices: do everyday work on a standard account and use administrator access only when needed. Admin-only accounts do not need a Microsoft 365 licence.

1. In the Microsoft 365 admin centre, list who holds Global Administrator and the other admin roles. Write down each person, the role and whether that account is also their everyday mailbox.
2. Flag anyone using an everyday account for admin work, and anyone holding Global Administrator where a narrower role would do. These are changes for later, not for this survey.
3. Check that your admins have a strong sign-in method. Microsoft supports Authenticator passwordless sign-in, passkeys (FIDO2) and Windows Hello for Business for admin accounts on every business tier, and Business Premium can require them through Conditional Access.
4. Check you have two emergency access accounts, sometimes called break-glass accounts. These are cloud-only Global Administrator accounts not tied to a person, kept for the day normal admin sign-in is locked out. How they interact with MFA depends on whether you use security defaults or Conditional Access, so follow Microsoft's emergency access guidance rather than improvising. Store the credentials somewhere more than one trusted person can reach.

Email: switch on the preset policies and decide what happens to forwarding

Every cloud mailbox gets built-in protection with default anti-malware, anti-spam and spoofing protection. Microsoft says the defaults are a good level, but recommends also assigning the Standard preset security policy, and optionally the Strict one, to get its recommended settings without hand-tuning each policy. In our judgement Standard for everyone is the sensible start, with Strict kept for small groups such as finance or directors if you want it.

The second job is automatic forwarding to outside addresses. It is useful, but it is also how an attacker who has compromised a mailbox keeps receiving a copy of its mail. The default setting is called Automatic - System-controlled, and Microsoft says it behaves differently depending on the age and history of your organisation, so it advises choosing On or Off explicitly.

1. In the Microsoft Defender portal at security.microsoft.com, go to Email & collaboration, then Policies & rules, then Threat policies, then Preset Security Policies. On a first visit Standard protection and Strict protection are likely to be off.
2. To turn Standard on, slide its toggle to On and select Manage protection settings. The wizard asks which recipients receive the protection. Choose Specific recipients and pick a few colleagues as a pilot, then widen to All recipients once you are happy. Tighter filtering can occasionally catch a legitimate message, so ask the pilot group to tell you if something goes missing. To roll back, switch the toggle off again.
3. Now read the forwarding setting. In the Defender portal go to Email & collaboration, then Policies & rules, then Threat policies, then Anti-spam, and open the policy named Anti-spam outbound policy (Default). Look at Automatic forwarding rules.
4. If you prefer the command line, this read-only command in Exchange Online PowerShell lists the setting for each outbound spam policy. It needs at least a Global Reader or Security Reader role and changes nothing.
   powershellCopy

   Connect-ExchangeOnline
   Get-HostedOutboundSpamFilterPolicy | Format-List Name,IsDefault,AutoForwardingMode

5. If it says Automatic - System-controlled, choose On or Off deliberately. Before choosing Off, open the Auto forwarded messages report in Exchange's mail flow reports to see who is forwarding externally and to where. Setting Off stops all automatic external forwarding, including legitimate rules, and external senders get a bounce containing the code 5.7.520. Check the report first and set it back to On if a forward turns out to be essential.

Email: check that your domains prove who they are

SPF is a DNS record listing the servers allowed to send mail for your domain. DKIM adds a digital signature to outgoing messages. DMARC tells receiving servers what to do when a message fails those checks and where to send reports. Together they make it harder for someone to impersonate you and help your genuine mail get delivered. Microsoft says to configure them in that order for every custom domain, including parked domains and subdomains you never send from.

You can check for their existence without touching anything. Replace YOUR_DOMAIN with your domain name in each command and run them from a Windows command prompt.

1. Run the three lookups below, one per record type.
   cmdCopy

   nslookup -type=TXT YOUR_DOMAIN
   nslookup -type=TXT _dmarc.YOUR_DOMAIN
   nslookup -type=CNAME selector1._domainkey.YOUR_DOMAIN

2. In the first result, look for a text record starting v=spf1. If you send only through Microsoft 365 it should include spf.protection.outlook.com. Any other service that sends as you, such as an invoicing system, should be listed too.
3. In the second result, look for a record starting v=DMARC1 with a p= policy. A policy of none only monitors and reports, which is a reasonable first stage but does not stop spoofing.
4. In the third result, a Microsoft 365 DKIM record is a CNAME pointing at your onmicrosoft.com domain. If it is missing, DKIM signing is not set up for that domain.
5. If anything is missing, pass the findings to whoever manages your DNS. Changing SPF or DMARC records carelessly can cause genuine mail to be rejected, so make those edits one record at a time using Microsoft's step-by-step guides.

Monitoring: make sure the record of what happened actually exists

When something goes wrong, the first question is 'what did that account do?'. You can only answer it if the logs were recording beforehand. Mailbox auditing is on by default in all organisations. The unified audit log, which records user and admin activity across Microsoft 365 services, is the one to verify: Microsoft states that auditing is not enabled by default for its Small and Medium Business licences, including Business Basic, Standard and Premium, whereas another Microsoft page describes it as on by default for organisations with the appropriate subscription. Because those statements disagree, do not assume. Check it.

You need the Audit Logs role in Exchange Online (held by default by the Organization Management and Compliance Management role groups) to read or change the setting.

1. Connect to Exchange Online PowerShell as an administrator. Run this in Exchange Online PowerShell specifically; the same property always shows False in Security & Compliance PowerShell, even when auditing is on.
   powershellCopy

   Connect-ExchangeOnline

2. Check the status. A value of True means the unified audit log is recording. False means it is not.
   powershellCopy

   Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

3. If it is False, turn it on. This starts recording and retaining user and admin activity for the organisation. Microsoft says it can take up to 60 minutes to take effect, and events may take several hours to become searchable. You can reverse it by setting the value to false, but do that only with a deliberate reason, because with auditing off the audit log search, Management Activity API and Microsoft Sentinel return nothing.
   powershellCopy

   Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

4. Check mailbox auditing. A value of False for AuditDisabled means mailbox auditing is on by default for the organisation.
   powershellCopy

   Get-OrganizationConfig | Format-List AuditDisabled

5. Open Sign-in logs in the Microsoft Entra admin center and note how far back they go. Entra ID Free keeps sign-in and audit logs for seven days, and Entra ID P1 (included in Business Premium) for 30 days. Those short windows are why the unified audit log matters. Microsoft documents 180 days for Audit (Standard), though you should confirm the retention that applies to your own licences.

Monitoring: make sure someone actually hears about alerts

Alert policies watch for things like risky mail activity or admin privilege changes and tell you about them. An alert nobody reads is the same as no alert. Microsoft's default outbound-spam alert policies (Email sending limit exceeded, Suspicious email sending patterns detected and User restricted from sending email) email the members of the TenantAdmins group, which means your Global Administrators. If your only Global Administrators are emergency accounts with no mailbox, those emails may reach no one. That is our inference from how the notification is described, so check it rather than assume it.

1. In the Defender portal go to Email & collaboration, then Policies & rules, then Alert policy. Review the default policies, open a few and check the notification options. Make sure an address someone reads is on the list.
2. Be aware that Microsoft's alert policy reference lists Enterprise plans as the organisations where alert policies are available, while its Business setup guidance sends Business administrators to this same page. If the page is missing or limited on your plan, treat it as a licence limit rather than a fault, and compensate with a regular look at sign-in logs and audit search. Changes to alert policies can take up to 24 hours to start generating alerts.
3. View triggered alerts under Incidents & alerts, then Alerts.
4. Open Microsoft Secure Score at security.microsoft.com/securescore. Treat it as a to-do list rather than a league table: it will award points for things that do not suit your business, and Microsoft says it is not a measure of how likely you are to be breached. If security defaults are on, three identity recommendations are awarded full points: all users able to complete MFA, MFA for administrative roles, and blocking legacy authentication.

Check it worked: a one-page record

The review is done when you can fill in the following from what you observed, not from what you assume. Keep it somewhere your colleagues can find it and re-run the read-only checks after any licence change.

• MFA is enforced by security defaults, Conditional Access or per-user MFA, and the test sign-in with an ordinary account asked for a second step.
• The list of admin role holders is written down, with any everyday-account admins and any Global Administrators flagged.
• Two emergency access accounts exist and their credentials are stored safely.
• Standard (and optionally Strict) preset protection is on for the recipients you chose, and automatic external forwarding is set explicitly to On or Off.
• SPF, DKIM and DMARC lookups return the records you expect for each domain.
• UnifiedAuditLogIngestionEnabled returns True and AuditDisabled returns False.
• A named person receives the alert emails and has looked at Secure Score.

If something does not match, or breaks

Most surprises come from legacy sign-ins, licence limits or caution about settings that overlap.

• A scanner, printer or old mail app stopped working after you enabled security defaults: it is almost certainly using legacy authentication. Do not switch security defaults off to get it working. Microsoft has a guide for setting up a multifunction device or application to send mail through Microsoft 365, and if you disable security defaults you should replace them with Conditional Access straight away.
• Security defaults will not turn on: a Conditional Access policy exists in some state. Either use Conditional Access as your MFA mechanism or remove all policies first.
• The audit setting reads False after you enabled it: allow up to 60 minutes, and confirm you ran the check in Exchange Online PowerShell.
• Audit search returns nothing straight after enabling: events can take several hours to become searchable.
• You find a forwarding rule you do not recognise, an unexpected admin account, or sign-ins from places that make no sense: treat it as a possible compromise rather than a settings tidy-up, and get help before you change anything that might destroy evidence.
• Conditional Access with many policies, hybrid Active Directory or several tenants: this baseline is the first pass, and the next step is a proper design review.