Microsoft 365 Security Checklist for Small Businesses

How to use it

Tick an item only when you can explain how the control works and where the evidence is. Record any gap, its owner and the next action. Controls available to you depend on your Microsoft 365 licences and configuration. This checklist is not a certification or a guarantee of security.

1. Identity and sign-in controls

Multifactor authentication (MFA): confirm MFA is required for administrators and appropriately enforced for users; document exceptions.

Sign-in activity: review sign-in logs for unfamiliar activity, repeated failures or suspicious patterns.

Legacy authentication: identify older protocols or apps that may bypass modern controls; test dependencies before blocking them.

Recovery: confirm users have a safe, documented process for recovering access when they lose an authentication device.

2. Administrator and privileged access

Review the list of users assigned Microsoft Entra or Microsoft 365 administrator roles.

Confirm each privileged role has a current business reason and remove unnecessary assignments.

Use separate day-to-day and administrative accounts where appropriate.

Document and carefully protect emergency-access accounts and review their use.

3. Email and domain protection

Review both Microsoft 365 email controls and the domain settings that help recipients verify messages.

Review anti-phishing, spam and malware protection policies available in your tenant.

Check SPF, DKIM and DMARC for your sending domain and record any gaps.

Look for unexpected mailbox forwarding and suspicious inbox rules.

Make sure staff know how to report suspicious messages and unexpected MFA prompts.

4. SharePoint, OneDrive and external sharing

Check whether business information is shared with the right people, for the right reasons.

Review organisation-wide external-sharing settings for SharePoint and OneDrive.

Find anonymous “Anyone” links and remove or restrict links that are no longer needed.

Review guest users and their access to sensitive sites, teams and document libraries.

Confirm permissions are reviewed when projects end or staff change roles.

5. Device access and staff lifecycle

Account security is stronger when the devices connecting to business data are also managed.

Maintain an inventory of business devices that access Microsoft 365.

Confirm supported devices receive security updates and have appropriate endpoint protection.

Review device access requirements; assess whether conditional access is appropriate for your licence and risk.

Use a joiner, mover and leaver process to grant, change and remove access promptly.

6. Recovery, retention and incident readiness

Understand what can be restored, how long it is retained and who is responsible when something goes wrong.

Identify business-critical Microsoft 365 data and document how it is protected.

Check retention and recovery arrangements against business and legal requirements.

Test restoration of representative files or data using the recovery process your organisation relies on.

Document who to contact and what to do after a compromised account, lost device or accidental deletion.

7. Logging and recurring review

Make sure relevant activity can be investigated and that findings lead to action.

Confirm relevant audit and sign-in logs are available and understand their retention periods.

Identify who reviews alerts and how urgent findings are escalated.

Schedule recurring reviews of administrators, guest access, sharing and sign-in activity.

Keep a record of findings, action owners, due dates and completion evidence.

Prioritise the work

Do not try to change every setting at once. Use the risk to the business to decide the order, and test changes before applying them broadly.

Priority 1 — Protect access

Address unprotected privileged accounts, unexplained sign-in activity, excessive administrator access and exposed sensitive files.

Priority 2 — Reduce exposure

Improve sharing controls, device coverage, offboarding and email/domain protection.

Priority 3 — Prove recovery

Confirm what is protected, review retention and perform a genuine recovery test.

Priority 4 — Keep it current

Assign owners for logs, alerts, regular reviews and staff guidance.

For each unchecked item, record the finding, evidence needed, owner, next step and target date. If a control is not included in your subscription, record that limitation rather than marking it complete.

Official Microsoft guidance

Microsoft changes its admin centres and licensing over time. Check current documentation and your tenant’s available settings before making changes.

NorthWave practical approach

Turn findings into a realistic action plan.

A useful outcome is a short list of improvements with owners and target dates, not a perfect score. NorthWave can help businesses review their IT environment and identify practical next steps.

Book a Free IT Health Check →Contact NorthWave