Microsoft 365 Security Checklist for a Small Office

Before you start

You need someone with Global Administrator rights and a quiet week. Change one area at a time and keep a short log: date, setting, what it was, what it is now. That log turns into evidence later, on a cyber insurance questionnaire or in a written security program.

This checklist fits a five-person dental front office in Arroyo Grande as well as a twenty-person engineering shop near Vandenberg Space Force Base. Offices on Google Workspace can follow the same ideas. The menus differ, the principles do not.

A note on scope: this is guidance, not a substitute for knowing your own tenant. Menus move around, so search Microsoft's admin documentation if a setting has a new name.

1. MFA on every account, admins first

Multi-factor authentication stops most password-only attacks cold. Two ways to turn it on:

• Security defaults: free in every tenant. Requires MFA registration for everyone and blocks legacy sign-ins. Good for small offices without complex needs.
• Conditional Access: included in higher-tier plans. Lets you write rules, for example requiring MFA everywhere and blocking sign-ins from countries you never work in.

Pick one, not a half-finished mix of both.

Then tighten the details:

• Prefer an authenticator app with number matching over text messages.
• Give admins phishing-resistant methods such as passkeys or hardware security keys.
• Block sign-in on shared mailboxes. Staff reach them through their own accounts, so nobody shares a password.
• Review each user's registered MFA methods. An attacker who gets in once will often add their own phone.

2. Admin accounts and app consent

Admin rights are the keys to the whole office. Treat them that way.

• Give admins a separate account, such as admin.jane@, that is never used for email or web browsing.
• Keep at least two Global Administrators and fewer than five, which matches Microsoft's own guidance.
• Use narrower roles where they fit: someone who resets passwords does not need Global Administrator.
• Keep one emergency access account with a long password stored offline, and test it twice a year.
• Know every outside account with admin rights, including any IT provider, and remove access when the relationship ends.
• Restrict users from granting third-party apps access to mail and files. Require admin approval instead. Consent phishing tricks a user into handing an attacker's app ongoing access, MFA or not.

3. Block legacy sign-ins, and find the scan-to-email copier

Legacy authentication protocols cannot do MFA. A stolen password works through them as if MFA did not exist.

Microsoft retired most basic authentication in Exchange Online in 2022. The common leftover is SMTP AUTH, which can still be enabled per mailbox. In small offices it is almost always there for one reason: a copier or printer that scans to email, or an old line-of-business app.

This is the classic "smart stuff on your network" problem. A device nobody thinks about keeps a weak sign-in path open for the whole tenant.

Checklist:

• Turn SMTP AUTH off for the organization and allow it only on the specific mailbox that truly needs it.
• Give that mailbox a long unique password, no admin rights and nothing sensitive in it.
• Turn off POP and IMAP for users who do not need them, which is usually everyone.
• Ask whoever supports the copier to move it to a supported sending method. Keith Systems reviews the account side; it does not configure or log into devices.

4. Mailbox forwarding and inbox rules

After an attacker takes over a mailbox, the first thing they usually do is make a rule. It forwards mail to an outside address, or quietly moves anything mentioning "invoice" or "payment" into a folder nobody opens.

Check these:

• Automatic external forwarding: in the outbound spam policy, external auto-forwarding should stay blocked. The default system setting blocks it. Confirm nobody changed it to "On."
• Mailbox-level forwarding: an admin can set forwarding on a mailbox directly. Look for any you did not approve.
• Inbox rules: review rules that delete messages, mark them read, or move them to RSS Feeds, Archive or Conversation History, especially ones keyed on words like invoice, payment, bank, wire or W-2.
• Mailbox permissions and delegates: confirm who can read or send as each mailbox.
• Alerts: Microsoft 365 includes alert policies for new forwarding and redirect rules. Make sure those alerts go to a person who reads them.

This ties directly to business email compromise prevention.

5. Sharing in SharePoint, OneDrive and Teams

External sharing has four broad levels: anyone with the link, new and existing guests, existing guests only, and only people in your organization.

For most small offices:

• Set the organization level to new and existing guests, or tighter.
• If you keep "Anyone" links, set them to expire, for example in 14 or 30 days.
• Make "Specific people" the default link type, so the safe choice is the easy one.
• Review guest users each quarter and remove the ones from finished projects.
• Check Teams guest and external access to make sure they match how you actually work.

Accountants and law offices sharing client files should tighten further. See accountants and law offices.

6. Backups: what Microsoft keeps and what it does not

Microsoft runs a resilient service. That is not the same thing as backing up your data against your own mistakes or a ransomware event.

What exists by default, in general terms: SharePoint and OneDrive recycle bins hold deleted items for up to 93 days. OneDrive can roll a whole library back to a point within the last 30 days. Exchange keeps recoverable deleted items for 14 days by default, adjustable to 30. When you delete a user, their mailbox and OneDrive go away after a short grace period unless you act.

Gaps that bite small offices:

• Ransomware on a laptop can encrypt synced files, and the damage syncs up.
• A departing employee's data disappears with the account.
• An attacker with admin rights can delete data and empty recycle bins.

Checklist:

• Keep a backup stored outside your Microsoft 365 tenant.
• Protect backup admin access with its own credentials and MFA.
• Restore a mailbox and a folder each quarter, and write down that it worked.
• Insurers commonly ask about tested backups, so keep the record.

The one-page checklist

• MFA required for everyone, through security defaults or Conditional Access
• Admins on phishing-resistant MFA
• Shared mailboxes blocked from direct sign-in
• Separate admin accounts, two to four Global Administrators
• Emergency access account tested
• Outside admin access listed and justified
• User consent to third-party apps restricted
• SMTP AUTH off except where justified, POP and IMAP off
• External auto-forwarding blocked
• Inbox rules and mailbox forwarding reviewed
• Forwarding alerts going to a real person
• External sharing limited, Anyone links expiring
• Guest users reviewed quarterly
• Separate backup outside the tenant, restore tested
• Change log kept

Keith Systems reviews these settings with you on your own accounts and gives you written findings. It does not take over administration of your tenant, and it is not a monitoring service. Read assessment vs managed IT, then book a free security consult or call (805) 800-8163.