For many small businesses, Microsoft 365 holds email, files, chats and meetings in one place. That makes protecting the accounts that access it one of the most worthwhile security tasks you can do. The areas below are a good starting point. Which features are available to you depends on your licences.
Turn on multifactor authentication
Passwords alone are easy to guess, reuse or steal. Multifactor authentication (MFA) asks for a second proof of identity, which makes a stolen password far less useful. Small tenants can use the security defaults Microsoft provides, which switch on a set of baseline protections including MFA registration. Businesses with suitable licences can use Conditional Access for more precise control.
Keep administrator access under control
- Keep the number of administrators small.
- Use separate admin accounts that are not used for everyday email and browsing.
- Follow Microsoft’s guidance on emergency access accounts so you are not locked out of your own tenant.
- Review who holds admin roles from time to time, especially after staff changes.
Protect email
Exchange Online includes baseline filtering, and some plans add further anti-phishing protection. Make sure SPF, DKIM and DMARC are set up for your domain, as these make it harder for others to impersonate you. It is also worth checking for mailbox rules that automatically forward mail outside the company, which can be a sign that an account has been compromised.
Review sharing settings
SharePoint and OneDrive make it easy to share files, including with people outside your company. Decide how external sharing should work, prefer sharing with named people over open links where you can, and review guest accounts periodically.
Manage devices and apps
Accounts are only as safe as the devices used to access them. Where licensing allows, a tool such as Microsoft Intune can help you require basic standards, such as a supported operating system and disk encryption, and remove company data from a lost device.
Watch sign-ins and alerts
Decide who receives security alerts and who looks at sign-in activity. An alert nobody reads does not protect anyone.
Do not treat retention as backup
Recycle bins and retention settings help you recover recently deleted items, but they are not the same as an independent backup. Decide, based on how critical your data is, whether you need a separate backup of Microsoft 365.
This article is general guidance. Microsoft changes its products and licensing over time, so check Microsoft’s current documentation before changing settings.