Start with the accounts that control everything

Microsoft 365 may hold your email, files, calendars, identities, and business communications. A compromised administrator or unprotected mailbox can affect far more than one user. Review the tenant using an authorized administrator and document any changes before applying them.

The available controls differ by subscription. Microsoft's Business Basic, Standard, and Premium plans do not include identical security and device-management capabilities.

1. Verify multifactor authentication coverage

Confirm that employees and administrators have appropriate multifactor authentication (MFA) protections and that the tenant's settings enforce them as intended. Microsoft's security defaults provide a baseline option without Entra ID P1 licensing; Conditional Access offers more granular policies with appropriate licensing.

Do not disable security defaults simply to experiment with Conditional Access. Plan a supported replacement policy first, test it with limited scope, and protect emergency access arrangements.

2. Review administrator access

Identify who has Global Administrator and other powerful roles. Remove unneeded privileges and avoid using a high-privilege account for everyday email or web browsing. Review former employees, vendor access, and emergency access procedures.

The goal is not to eliminate administration; it is to reduce the number of accounts that can make business-wide changes and to ensure the remaining access is protected.

3. Check email authentication

For the business domain, review SPF, DKIM, and DMARC. These mechanisms help receiving systems evaluate whether mail claiming to come from your domain is authorized. Correct configuration depends on every legitimate sender, including websites, accounting products, marketing systems, and helpdesk software.

Do not copy another company's DNS records. A restrictive change can disrupt legitimate mail if the sender inventory is incomplete. Monitor authentication reports and test real messages after changes.

4. Examine mailbox forwarding and suspicious sign-ins

Unexpected external forwarding, new inbox rules, suspicious OAuth app permissions, or sign-ins from unfamiliar devices may indicate a problem. Review available audit information and alerts based on the licenses and retention settings in use.

Where an account is suspected compromised, follow a coordinated response process rather than only changing its password and assuming the issue is over.

5. Know how company devices are protected

Check endpoint protection, operating-system updates, disk encryption, device ownership, and the ability to remove company access when equipment is lost or an employee leaves. Business Premium includes Intune and Defender for Business capabilities, but they require actual configuration and monitoring.

For personally owned devices, decide how company data is separated from personal information and which access policies are acceptable.

6. Review file sharing and permissions

Inspect who can share SharePoint and OneDrive content outside the organization, whether anonymous links are permitted, and whether sensitive folders have the right owners. A sharing policy should match how the business collaborates with customers and vendors.

Also review accounts belonging to former employees and shared links that no longer serve a business purpose.

7. Confirm how cloud data can be recovered

Version history and recycle bins help with some mistakes, but they do not answer every recovery question. Identify the company's retention needs, important SharePoint sites, mailboxes, and what would be required to restore service after deletion or account compromise.

Test a representative recovery workflow and decide whether a separate Microsoft 365 backup product is appropriate.

8. Make sure alerts reach someone

Security tools cannot help if nobody reviews their warnings. Define who receives important alerts, which events require urgent action, and how to reach the responsible person if normal email is unavailable.

A short monthly review of users, admin roles, failed backup jobs, and notable security alerts is more useful than a dashboard nobody opens.

A reasonable order of operations

Start with accounts and MFA, then administrative access, endpoint protection, email authentication, sharing, recovery, and alert handling. Document the current state before changing multiple settings at once. Where licensing is insufficient, identify the specific risk and choose an appropriate remedy rather than upgrading everyone automatically.

Bottom line: Security comes from deployed controls, regular review, and workable recovery procedures. A small tenant deserves the same basic discipline as a large one, without unnecessary complexity.