· Zakaria B. · Cybersecurity · 3 min read
The Microsoft 365 security checklist most SMEs are missing
You already pay for more security than you use. Ten Microsoft 365 settings that close the most common gaps — most included in licenses you already own.
In most Microsoft 365 security reviews we run, the finding is the same: the organization already pays for the security features that would have stopped their last incident. They were just never turned on.
Here are the ten controls we check first — in rough order of impact.
Identity: where almost every attack starts
1. Enforce MFA for everyone — properly. Not “enabled”, not “registered but optional”: enforced, ideally via Conditional Access policies rather than legacy per-user settings. Prefer the Authenticator app over SMS where possible.
2. Block legacy authentication. Old protocols (IMAP, POP, SMTP basic auth) bypass MFA entirely. Attackers know this; that’s why password-spray attacks target them. One Conditional Access policy closes the door.
3. Protect privileged accounts separately. Global admin accounts should be dedicated (not someone’s daily mailbox), limited in number, and protected with the strictest policies. Break-glass account documented and stored safely.
4. Review third-party app consents. Users can unknowingly grant data access to malicious apps via OAuth consent phishing. Restrict user consent and review what’s already been granted — the results often surprise.
Email: your biggest attack surface
5. Configure SPF, DKIM and DMARC. These DNS records stop attackers from sending mail as you — the technical foundation against the invoice-fraud scams hitting businesses in both Morocco and Canada. DMARC in enforcement mode (p=quarantine or p=reject), not just monitoring.
6. Turn on the anti-phishing features you own. Defender for Office 365 (included in Business Premium) brings Safe Links, Safe Attachments and impersonation protection. If you pay for Business Premium and haven’t configured these, you’re leaving your best armor in the box.
7. Disable auto-forwarding to external addresses. A classic post-compromise move is a silent rule forwarding every invoice email outside. Block it tenant-wide and alert on exceptions.
Devices and data
8. Enroll devices in Intune with compliance policies. Encryption (BitLocker), screen lock, patch level — enforced, not hoped for. A stolen laptop should be an inconvenience, not a breach notification.
9. Set up data loss prevention basics. Even simple DLP policies (block external sharing of files containing ID numbers or payment data) catch honest mistakes before they become incidents.
10. Verify your backup story. Microsoft’s built-in retention is not a backup strategy. Know your recovery point and recovery time for mail, OneDrive and SharePoint — and test a restore before you need one.
The meta-lesson
None of this requires buying new products. It requires knowing the settings exist, understanding their side effects, and rolling them out without breaking the business — which is exactly the kind of work that benefits from someone who has done it many times.
We run this review as a fixed-scope engagement: your tenant, scored against this checklist and more, with remediation done or documented. Get in touch if you’d like to know where your tenant stands.
