microsoft 365 security checklist

SMB Microsoft 365 Security: Crawl, Walk, Run Checklist in 30–90 Days

Administrator reviewing Microsoft 365 security setup

The security floor every Microsoft 365 tenant should hit first is phishing-resistant multi-factor authentication, Conditional Access, and Intune device compliance. Layer those three controls and you block most of what actually breaches small businesses today. The two fastest wins: enable MFA for every user this week, and lock down your admin accounts before you do anything else. Everything below builds on that foundation.

TL;DR:

Enforcing phishing-resistant multi-factor authentication and locking down admin accounts are critical first steps that prevent most common breaches in small businesses.

Deploying Conditional Access policies in report mode and reviewing sign-in logs help identify issues before enforcing policies, reducing risks of lockouts.

Requiring FIDO2 keys, passkeys, or Windows Hello for admin accounts significantly reduces credential theft risk, especially against session interception attacks.

Configuring email security with Safe Links, Safe Attachments, and proper DNS authentication records (SPF, DKIM, DMARC) greatly diminishes phishing success.

Extending audit log retention to 365 days and performing regular backup restore tests are essential for effective incident response and ransomware recovery.

Prioritized Microsoft 365 Security Checklist: Crawl, Walk, Run
What Are the Three Controls Every Tenant Needs First?
How Do You Lock Down Identity and Admin Access?
Which Email and Defender Settings Stop Phishing?
How Do You Secure Devices With Intune?
How Do You Prevent Data Leaks in SharePoint and OneDrive?
Why Do Logging and Backup Matter for Incident Response?
What Does a 30 to 90 Day Rollout Actually Look Like?
What Small IT Teams Get Wrong About Security Priorities
How Greatplainsnetworking Helps You Close the Gap
Where to Verify These Settings Yourself
Sources
FAQ

Prioritized Microsoft 365 Security Checklist: Crawl, Walk, Run

Not every control matters equally, and trying to deploy all of them at once is how small IT teams stall out. Microsoft's own guidance for business security best practices points to MFA, admin protection, preset security policies, and device controls as the top tasks for SMBs, in roughly that order.

Crawl: Enforce MFA for all users, block legacy authentication, protect Global Admin accounts, and turn on Security Defaults as a stopgap.
Walk: Build Conditional Access policies in report-only mode first, then enforce. Enroll devices in Intune. Turn on Safe Links and Safe Attachments.
Run: Deploy Privileged Identity Management, write DLP rules and sensitivity labels, enable full Defender XDR correlation, extend audit log retention, and add third-party backups.

Pro Tip: Don't skip the report-only step on Conditional Access. Reviewing sign-in logs for two weeks before you enforce a policy catches the app or device that would otherwise lock out your CFO on a Friday afternoon.

What Are the Three Controls Every Tenant Needs First?

Three Microsoft 365 tenant security controls

Phishing-resistant MFA, Conditional Access, and Intune device compliance form the security floor. Attackers now routinely bypass SMS and app-based MFA codes using adversary-in-the-middle proxy kits that intercept the session token after login. Phishing-resistant methods, FIDO2 keys, passkeys, and Windows Hello, close that gap because there's no code to relay.

Roll these out in order:

Create at least two break-glass emergency accounts, backed by FIDO2 keys and excluded from Conditional Access, before touching anything else.
Run Microsoft-managed Conditional Access policies in report-only mode and watch the sign-in logs for two weeks.
Move admins to phishing-resistant MFA before enforcing tenant-wide policies.

How Do You Lock Down Identity and Admin Access?

Identity is where most Microsoft 365 breaches start, and it's where the highest-leverage fixes live. Start with admin accounts specifically, since a single compromised Global Admin gives an attacker the whole tenant.

Require phishing-resistant MFA (FIDO2, passkeys, Windows Hello) for every admin account, and roll it to standard users on a set schedule rather than "eventually."
Set Conditional Access to block legacy authentication protocols outright. Nothing modern needs them, and they're the most common bypass path for stolen credentials.
Require compliant devices for sign-in, but only after Intune compliance policies actually exist. An enforcement rule with no defined criteria behind it just breaks logins.
Remove standing Global Admin assignments for daily work. Assign role-specific admin roles instead, and use Privileged Identity Management for just-in-time elevation.
Name break-glass accounts something boring and undocumented in shared wikis. Store the credentials offline.

Pro Tip: Audit your Global Admin count quarterly. If you count more than two or three, you almost certainly have accounts that no longer need that level of access.

Which Email and Defender Settings Stop Phishing?

Email remains the most common way attackers get a foothold in a small business, and Defender presets close most of that gap without custom rule-building.

Apply the Defender for Office 365 Strict preset to your executive team and finance staff, and Standard preset for everyone else, then tune based on false positives.
Turn on Safe Links and Safe Attachments so malicious URLs and files get scanned at the time someone actually clicks them, not just at delivery.
Configure anti-phishing impersonation protection specifically for your C-suite names and your own domain, since business email compromise usually spoofs a name your staff already trusts.
Publish SPF, DKIM, and DMARC records, starting DMARC in monitoring mode (p=none) for a few weeks before moving to quarantine, then reject.
Add a tenant allow/block list entry for any sender domains you've confirmed are malicious, and let Teams link protection scan at time of click, too.

How Do You Secure Devices With Intune?

Identity controls only work if the device on the other end is trustworthy, which is where Intune enrollment and compliance policies do the real work.

Decide your enrollment model per device type: full MDM for company-owned laptops, app-level MAM for personal phones under BYOD.
Build a minimum compliance policy: disk encryption enabled, OS patches current, antivirus or EDR active, and a screen lock timeout under 15 minutes.
Pilot the compliance policy with a small group, IT staff first, for two weeks before requiring it tenant-wide.
Only flip Conditional Access to "require compliant device" after the pilot group shows a clean compliance report. Enforcing before the policy exists just locks out real users with no clear fix.
Watch for the most common enrollment failure: devices stuck in "pending" because of conflicting existing MDM profiles from a prior IT vendor.

How Do You Prevent Data Leaks in SharePoint and OneDrive?

Most accidental data exposure in Microsoft 365 comes from default sharing settings that are far more permissive than anyone intended, not from sophisticated attacks.

Change the SharePoint and OneDrive default link type from "anyone" to "specific people," and the default permission from edit to view.
Start with Microsoft's built-in DLP templates for financial data and personal information, run them in test mode, and review the alerts before switching to enforce.
Publish three sensitivity labels to start: Public, Internal, and Confidential, with the Confidential label triggering encryption automatically.
Roll out labeling and DLP in phases. Enforcing broad rules on day one generates a flood of user complaints and false blocks that erode trust in the whole program. Firms with regulatory obligations should map these labels directly to the applicable standard, such as the HIPAA Security Rule for healthcare practices handling patient records.

Why Do Logging and Backup Matter for Incident Response?

You can't investigate what you didn't log, and you can't recover from ransomware with retention settings alone.

Enable the Unified Audit Log if it isn't already, and extend retention. Microsoft's own guidance notes that default retention is often too short for a real forensic timeline, and recommends extending to 365 days.
Set alert policies for impossible travel sign-ins, new mailbox forwarding rules, mass file downloads, and role elevation events, with a named owner who actually reviews them.
Add third-party, immutable backups. Microsoft retains your data operationally, but it doesn't provide a tenant-agnostic, point-in-time snapshot built for ransomware recovery.
Run a restore test at least quarterly. A backup nobody has restored from is a hypothesis, not a safety net.

Default Unified Audit Log retention leaves many small businesses with a shorter forensic window than an actual investigation needs, which is why extending retention for a longer period matters before an incident forces the question.

What Does a 30 to 90 Day Rollout Actually Look Like?

A realistic hardening project follows seven workstreams: identity, email, endpoint, data protection, logging, backup, and ongoing maintenance, sequenced so nothing breaks production along the way.

Weeks 1 to 2: Create break-glass accounts, enable Security Defaults or baseline MFA, and set legacy auth blocking to report-only.
Weeks 3 to 6: Pilot Conditional Access policies, move admins to FIDO2, enable Defender presets, and start an Intune pilot group.
Weeks 7 to 12: Enforce Conditional Access tenant-wide, complete Intune onboarding, move DLP from test to block, extend audit retention to 365 days, and run your first backup restore test.
Ongoing: Document your baseline configuration, assign an owner to each control, and schedule a quarterly review to catch configuration drift.

Pro Tip: Treat Microsoft Secure Score as a diagnostic, not a target. A high score with the wrong priorities is worse than a moderate score built around your actual risk. Rank fixes by what would hurt most if it failed, not by what moves the number fastest.

What Small IT Teams Get Wrong About Security Priorities

Most small IT teams try to chase every Secure Score recommendation at once, and end up half-finishing a dozen controls instead of fully deploying three that matter. The security floor, identity, Conditional Access, device compliance, does more real-world work than a longer list of partially configured settings. Once that floor holds, layered protections like DLP and extended audit logging matter more. When staff time runs out before compliance deadlines or restore testing does, that's the point to bring in outside support, not a sign of failure. Related sector guidance, like this walkthrough on securing Microsoft 365 for law firms, shows how the same floor adapts to regulated industries.

— Nicholas

How Greatplainsnetworking Helps You Close the Gap

Building this checklist is one thing. Maintaining it while running a dental practice, law firm, or accounting shop is another. Greatplainsnetworking offers 24/7 monitoring to catch configuration drift and suspicious sign-ins before they become an incident.

Our Microsoft 365 Support service covers the identity, Conditional Access, and Intune deployment work outlined above, paired with Managed IT Support for ongoing monitoring and same-day response when something needs attention. If backup and restore testing is the piece you keep putting off, our Backup & Recovery team builds and tests that safety net for you. We don't do long-term contracts, and we're upfront that this is Microsoft 365 configuration and monitoring, not a general software development shop. Start with a free network assessment to see exactly where your tenant stands against this checklist before you commit to anything.

Where to Verify These Settings Yourself

Microsoft 365 for business security best practices for the canonical top-tasks list.
Microsoft 365 Business Premium product page for the licensing baseline.
Microsoft guidance: Microsoft 365 zero trust for Conditional Access and device access design.
Microsoft Purview audit log retention guidance for extending retention windows.
Our own Small IT Teams MFA guide and Intune Device Compliance walkthrough for step-by-step deployment help.

Sources

FAQ

Is There a Microsoft Checklist App or Tool?

Microsoft doesn't ship a dedicated "checklist app," but Secure Score inside the Microsoft 365 Defender portal tracks your configuration against recommended controls and shows what's missing. Treat it as a measurement dashboard rather than a strategy. It's useful for tracking progress, not for deciding what matters most for your specific business.

What Security Features Come Included With Microsoft 365?

The features included depend entirely on your license tier. Business Premium adds Entra ID P1, Intune, Defender for Business, and Defender for Office 365 Plan 1 on top of the core apps, which is why it functions as the practical licensing floor for small businesses that want real security controls rather than basic email filtering.

What Is the Best Hardening Checklist to Follow?

The most reliable approach follows Microsoft's own top-tasks guidance: MFA, admin account protection, preset security policies, device protection, and secure sharing defaults, deployed in a phased Crawl, Walk, Run sequence rather than all at once.

What Are the Core Microsoft 365 Security Tools I Should Know?

Conditional Access, Intune, Defender for Office 365, Microsoft Purview (for DLP and audit logs), and Privileged Identity Management form the core toolset. Each one maps to a specific layer of the checklist: identity, device, email, data, and access governance, respectively.

Does Greatplainsnetworking Handle Microsoft 365 Security Setup?

Yes. Greatplainsnetworking configures Conditional Access, Intune enrollment, Defender presets, and backup strategy as part of its Microsoft 365 Support service for small businesses in the Oklahoma City metro area. Pricing is available on request after a free network assessment.

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

SMB Microsoft 365 Security: Crawl, Walk, Run Checklist in 30–90 Days