A checklist is only useful if it is specific. Most Microsoft 365 security guides are either too vague to act on or too technical for anyone outside IT to understand.

This one is built for business owners, office managers, and IT teams at small businesses who want to know what to check and why it matters. Work through this list with whoever manages your Microsoft 365 environment.

How to Use This Checklist

For each item, confirm: Is this configured? Who is responsible for it? When was it last reviewed? If you cannot answer those questions, put it on your follow-up list.

Identity and Access Controls

These items control who can access your Microsoft 365 environment and how.

• MFA is enabled for all users. No exceptions. Every account, including executives, contractors, and shared accounts, should require MFA.
• MFA is enabled for all admin accounts. Admin accounts need MFA even if you have already confirmed it for regular users. Check separately.
• Legacy authentication protocols are blocked. Use a conditional access policy to block sign-ins using older protocols that bypass MFA.
• Conditional access policies are in place. At minimum: block risky sign-in locations, require compliant devices for sensitive apps, and apply a baseline policy for all users.
• Security defaults or named policies are active. Confirm Security Defaults are set correctly or that your custom conditional access policies are active.
• Self-service password reset is configured with identity verification. If users reset their own passwords, verify they must confirm identity first.

Admin Account Security

• Global admin accounts are separate from daily-use accounts. No one should use their global admin account for regular email, Teams, or SharePoint.
• Global admin count is limited. Most small businesses need two or three global admins at most.
• Emergency access accounts are documented and secured. Have one or two break-glass accounts with credentials stored securely offline.

Email and Mailbox Security

• Anti-phishing policies are configured. Microsoft Defender for Office 365 includes anti-phishing policies. Confirm they are active.
• DMARC, DKIM, and SPF records are published. These email authentication records help prevent attackers from spoofing your domain.
• Automatic external email forwarding is blocked. Set your mail flow rules or outbound spam policy to block automatic forwarding to external addresses.
• Mailboxes are audited for unexpected forwarding rules. Run a mailbox audit to check for forwarding rules that were not set by your team.
• Safe Links and Safe Attachments are enabled. If you have Microsoft Defender for Office 365 Plan 1 or higher, these should be active for all users.

Data and File Security

• External sharing in SharePoint and OneDrive is restricted. Confirm sharing settings match your business needs. Anonymous sharing links should be limited or disabled.
• Sensitivity labels are in use for confidential documents. If you handle sensitive client or financial data, Microsoft Purview sensitivity labels help control access.

Device Security

• Intune enrollment or conditional access device requirements are in place. Devices that access Microsoft 365 should meet compliance requirements.
• Mobile Device Management policies are enforced. Remote wipe, screen lock, and encryption requirements should apply to any device with access to business data.

Monitoring and Logging

• Unified audit logging is enabled. Confirm that audit logging is turned on in the Microsoft Purview compliance portal.
• Alert policies are active. Confirm that high-priority alerts are routed to someone who will act on them.
• Microsoft Secure Score is reviewed regularly. Review your organization’s Microsoft Secure Score and track it over time.

After the Checklist

Going through this list often reveals gaps that were not visible before. That is the point. Knowing where you stand is the first step toward closing the right gaps first.

If you work through this checklist and need help prioritizing what to fix or implementing changes, that is exactly what NexSecure Solutions LLC is built for.

Nigel Roberts, CISSP, works directly with small business owners and IT teams to review Microsoft 365 environments and build practical hardening plans based on what the business actually needs.

Our Microsoft 365 hardening and cybersecurity services are structured for small businesses that want expert guidance without enterprise overhead.

Contact NexSecure Solutions LLC for a practical Microsoft 365 hardening plan. We review your environment, map your gaps, and give you a prioritized action plan you can actually execute.