Home / Insights / M365 Security Checklist
Microsoft 365
M365 Security Checklist
Free download: the essential settings every Irish SME should have configured.
Most Microsoft 365 tenants are set up with default settings and never revisited. Here is a practical checklist covering the highest-impact security settings, five minutes to skim, worth acting on this week.
Identity & access
- Multi-factor authentication (MFA) enforced for every user, no exceptions
- Legacy authentication protocols disabled (they bypass MFA entirely)
- Conditional Access policies in place for at least sign-in risk and location
- Admin accounts separated from everyday user accounts
Email protection
- SPF, DKIM, and DMARC correctly configured for your domain
- Anti-phishing and anti-spoofing policies enabled, not left on Microsoft defaults
- External email tagged clearly so staff can spot spoofed internal-looking messages
Data protection
- Data Loss Prevention (DLP) policies covering at minimum financial and personal data
- Sensitivity labels applied to confidential document libraries
- Sharing settings reviewed, Anyone with the link is rarely the right default
Device & backup
- Devices enrolled in Intune or an equivalent MDM, not accessing company data unmanaged
- Microsoft 365 data backed up independently of Microsoft own retention
If more than two or three of these are not in place, that is a reasonable starting point for a proper audit rather than trying to fix everything piecemeal.
A sensible order to work through it
Do not try to fix everything in one go. A workable order is: first week, turn on MFA for every account, block legacy authentication and check who holds admin roles. First month, put Conditional Access in place, review guest and external sharing, and confirm email authentication (SPF, DKIM and DMARC) is configured for your domain. First quarter, enrol remaining devices in Intune, add sensitivity labels and data-loss-prevention rules, and test a restore from your independent backup.
Two things people forget
- Admin account hygiene. Admins should use separate, cloud-only accounts for admin work, not their daily mailbox. Keep two emergency (break-glass) accounts with strong credentials stored offline, excluded from Conditional Access, and alert on every sign-in.
- Somebody has to look. Turn on audit logging, review Microsoft Secure Score monthly and set alerts for risky sign-ins. A setting nobody monitors only protects you until it is changed.