In short
- ✓Turn on MFA for every user: Security Defaults does this free on any Microsoft 365 plan.
- ✓Use separate admin accounts and keep the number of admins small.
- ✓Block old sign-in methods that bypass MFA.
- ✓Check for forwarding rules and limit external sharing.
- ✓Back up Microsoft 365 separately: Microsoft keeps the service running, not your history.
Why Microsoft 365 is a target
For most small businesses, Microsoft 365 holds email, files and calendars in one place, so one stolen password can expose everything. The government's 2025 Cyber Security Breaches Survey found only 40% of UK businesses use two-factor authentication. Since April 2026, Cyber Essentials also requires MFA on cloud services such as Microsoft 365.
The 10-point Microsoft 365 checklist
- Turn on multi-factor authentication for every user. Security Defaults enables it at no cost on any plan; Business Premium adds Conditional Access for finer control.
- Create separate admin accounts, protect them with MFA and keep global admins to two or three.
- Block legacy authentication, which lets attackers sign in without MFA.
- Review Microsoft Secure Score and work through the high-impact recommendations.
- Check every mailbox for forwarding rules to outside addresses, and block automatic external forwarding.
- Limit external sharing in SharePoint and OneDrive to what you actually need, and set links to expire.
- Turn on alerts for suspicious sign-ins and new inbox rules.
- Enable Microsoft Defender protections for email links and attachments where your plan includes them.
- Remove accounts and licences for leavers on the day they leave.
- Back up mailboxes, OneDrive and SharePoint with a separate backup service.
Do you need extra licences?
Often not. Security Defaults, Secure Score and many protections are included in every plan. Microsoft 365 Business Premium adds Conditional Access, device management and Defender for Business, which is worth considering if you handle sensitive data or need finer control over how and where people sign in.
Questions
Is Microsoft 365 secure out of the box?
Not fully. Many protections, like blocking external forwarding and limiting sharing, need configuring. Turning on MFA is the most important first step.
Does Microsoft back up my Microsoft 365 data?
Microsoft keeps the service running and offers limited recovery windows, but recommends a separate backup for long-term protection of mailboxes and files.