Microsoft 365 security checklist for small business: the admin center walk

Half the small businesses reading this run on Microsoft 365, and most of those tenants are held together by one admin who opened the portal twice. That's the honest version, and it's also the risk version: the tenant defaults were written for a world where every user sat behind an office firewall, and the settings that quietly leak — external sharing, app consents, forwarding rules, legacy authentication — are all still at their defaults in a typical small tenant. Google Workspace gets the security content and Microsoft 365 gets told "enable MFA" as if that were the whole story. This checklist is the missing half: one sitting in the admin center, an hour to run, and a quarterly repeat. If you're on Google instead, the Google Workspace security checklist is its twin; the settings differ, the discipline doesn't.

1. Start with Secure Score (it's a to-do list someone else wrote)

• Open the Secure Score in the Defender or admin portal and screenshot it. That number is your baseline. The point isn't the score itself — it's that Microsoft has already ranked the improvements for your tenant, worst-gap first. You're reading your homework, not doing research.
• Do the top five before anything else. In a default small tenant they're almost always the same: MFA for all users, legacy authentication off, mailbox forwarding alerts, the "user can consent to apps" toggle, and admin MFA. This page walks all five in the sections below.
• Re-check the score quarterly. The number should ratchet up as you close items. A score that's flat for two quarters is a checklist that stopped being run — the same drift the annual security review is designed to catch.
• Ignore the items that don't fit your size. Some recommendations assume E5 licenses, Sentinel, and a SOC. Mark them "reviewed, not applicable" and move on — don't let enterprise noise stall the small-tenant wins.

2. The admin handshake (who owns the tenant)

• Confirm who holds Global Admin. Admin centers → Roles → Global Administrator. A tenant created five years ago often has the founder's personal Microsoft account as its only admin — an account nobody at the company can reset. Fix the ownership now; this is the Microsoft version of the domain hijack problem, and the recovery path is slower.
• Keep two to three Global Admins, no more. One primary, one backup, both with MFA and dedicated admin accounts if you can manage it. Every other admin role should be scoped — Exchange Admin for the mail person, User Admin for onboarding.
• Use a break-glass account. One cloud-only admin account, long password in the password manager, MFA via a hardware key or authenticator app (not SMS to a phone that changes), used only when federation or normal MFA fails. Write the storage location into your ops notes; a break-glass account nobody can find is the same as none.
• Check the admin list against the org chart. Former employees holding admin roles is the default state of unreviewed tenants. Demote with confidence — it's reversible, and the audit log will thank you.

3. MFA and conditional access (the two settings that stop most takeovers)

• Turn on the Entra ID "security defaults" or build one real Conditional Access policy. Small tenant with no special needs: security defaults (MFA for everyone, blocked legacy auth) is a ten-minute win. If you have any licensing beyond free, one Conditional Access policy — "all users, require MFA, exclude the break-glass account" — is the grown-up version and scales better.
• Kill legacy authentication explicitly. POP, IMAP, and old ActiveSync clients can't do MFA, which makes them the tunnel around every other control. If someone still uses a 2012 email client, that's a project; until it's fixed, a conditional access rule blocking legacy auth is the difference between "we have MFA" and "we have MFA with a door open."
• Push authenticator app over SMS. SMS MFA still beats nothing, but SIM-swap attacks make the app version the default. Entra's Authentication Methods policy lets you allow app-based and de-prioritize SMS in one screen.
• Roll out with the same discipline as any MFA project. The MFA rollout checklist covers the human side: break-glass first, champions, the Friday-afternoon lockout trap. The tenant switch is ten minutes; the people part is the project.

4. Mailbox rules and forwarding (where Business Email Compromise lives)

• Ban or alert on automatic forwarding to external addresses. Exchange admin center → mail flow → remote domains, and the anti-spam outbound policy. A forwarding rule is the classic move after an account takeover: mail keeps arriving, the owner notices nothing, the attacker reads everything — including the invoice emails that become wire fraud.
• Review existing transport rules and inbox rules. Attackers who got in once leave delete-forward rules named "…" hiding in mailboxes. Admin center → mail flow → rules: anything you can't explain gets read in full or deleted.
• Turn on mailbox forwarding alerts (or read them). Defender alerts on suspicious forwarding activity in most tenants. If alerts exist and nobody reads them, set one forwarding rule to a distribution list that actually has people on it.
• Check the "sent items" delegation on finance mailboxes. Full-access permissions granted years ago to a former bookkeeper's account are the quiet version of the same hole. Exchange → mailbox → mailbox delegation: trim to current, named people.

5. App consents and integrations (the OAuth sprawl nobody reviews)

• Set "users can consent to apps" to off (admin consent required). Entra → Enterprise applications → Consent and permissions. The default lets any user approve any app — which is how one convincing "Allow Access" click hands an attacker a mailbox-reading token. With admin consent on, a malicious app request becomes a helpdesk ticket instead of a breach.
• Audit the consents already granted. Enterprise applications, sort by permissions, look for Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, and anything with "impersonation." For each: who approved it, does anyone still use it? Revoke boldly — if a tool matters, someone will ask for it back within a week.
• Apply the same rule you use for Slack apps. The Slack app audit and this are the same discipline in two buildings: one approval gate, one inventory, one quarterly purge.
• Watch for consent phishing in the wild. The lure looks like a normal login and ends on a Microsoft consent screen. "Why is this app asking to read my mail?" belongs in your phishing training deck — it's the 2020s version of the fake invoice attachment.

6. External sharing (OneDrive, SharePoint, Teams files)

• Pick your sharing defaults on purpose. SharePoint admin center → Sharing. "Anyone with the link" is convenient for the same reason it's dangerous: the link outruns the recipient list. Most small tenants are fine with "specific people" as the default and "anyone" allowed but expiring.
• Turn on link expiry and passcodes for anyone-links. If you keep anonymous links at all, 30-day expiry and optional passcode make them contracts instead of land grants.
• Review guest access in Teams and SharePoint quarterly. Guests accrete like everything else; the project's over, the consultant's gone, the files still live in a channel they can read. One admin pass, downgrade or remove — it's the offboarding checklist applied to Microsoft land.
• Decide where customer data lives and say so. One SharePoint site for customer material with tighter sharing settings beats five Teams channels with three wikis and a shared OneDrive folder. Structure is a security control.

7. Email security settings (Defender's free tier is better than its reputation)

• Confirm SPF, DKIM, and DMARC are actually set. The SPF/DKIM/DMARC checklist walks the DNS side; in the tenant, Defender → the DKIM panel per custom domain is where signing gets switched on. Microsoft 365 adds a default SPF include, but custom domains routinely ship without DMARC at all.
• Turn on anti-phishing protections in Defender. Safe Links and Safe Attachments are included in Business Premium and cheap elsewhere. Default thresholds are fine for a small tenant; the wins are impersonation protection for your executives and domain names.
• Set up the quarantine digest so users self-release. A weekly digest with "review, release, block" buttons keeps legit mail moving without giving everyone the admin password. Mail sitting in quarantine for a week is the #1 reason small teams disable protections.
• Report-phish button on, review the submissions. The built-in Report button feeds your own tenant's filtering. Fifteen minutes a week reading what users report tells you which lure is current in your industry.

8. Devices (Intune or the honest alternative)

• If you have Business Premium, use Intune — even minimally. Enrollment of company laptops plus one compliance policy ("disk encrypted, screen lock, OS not ancient") turns lost laptops from an incident into a wipe command. The lost laptop runbook gets shorter the day devices are enrolled.
• Enforce BitLocker/FileVault encryption. Intune can require it; if you're not using Intune, check it manually per machine and record it in the inventory. An unencrypted laptop is a data breach waiting for a parking lot.
• Set a screen-lock and password policy users can live with. Five minutes idle, lock on lid close, minimum password length handled by the identity side. Security policies that fight daily workflow get silently disabled; design them to survive contact with real work.
• Windows Update rings beat per-machine hope. The patch management checklist applies; Intune update rings are just its Microsoft-flavored implementation — canary first, fleet second, restarts scheduled not surprised.

9. Audit logs and alerts (the tenant's black box)

• Confirm audit logging is on (it is by default — confirm anyway). Purview → Audit. The unified audit log is what answers "who did what" after an incident; discovering it was disabled after an incident is its own incident.
• Route the five alerts that matter to a human. Suspicious activity, impossible travel, mass file deletion, new admin role granted, malware detected. Defender or Entra can email these to a distribution list — pick the list your escalation policy already points at.
• Log retention: match it to your incident needs. Free tier holds 90 days in the unified log; Business Premium extends it. If your incident response plan assumes you can reconstruct last month, make sure the logs exist that long.
• Do a five-minute monthly log skim. New apps consented, new admins, anomalous sign-ins. It's not a SOC; it's the same weekly-walk habit as patching, pointed at identity instead of devices.

10. The quarterly pass (everything above, in 45 minutes)

• Secure Score delta first. Compare to last quarter's screenshot. Anything you closed should stay closed; anything new and top-five goes on this quarter's list.
• Admins, consents, forwarding rules, guests. The four lists that accrete. Each one trimmed back to named, current, explainable.
• Spot-check one mailbox and one laptop. Forwarding rules on a random finance mailbox, encryption and updates on a random laptop. Two spot checks catch drift that list reviews miss.
• Write the three-line summary. Date, score, what changed, what's accepted risk. It feeds the annual review and answers the customer questionnaire's security section before it's asked — the same evidence folder the questionnaire template builds.

Microsoft 365 security for a small tenant is one admin-center sitting: Secure Score's top five, real MFA everywhere with legacy auth closed, forwarding locked down, app consents gated, sharing defaults chosen on purpose, Defender's free tier switched on, and a quarterly pass that trims the four lists that accrete. The Ops Starter Kit ($14) includes the per-tenant walkthrough sheets and the patch-and-access log, and the Automation Starter Pack ($19) automates the recurring reviews so the tenant stays tight between passes. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.