Microsoft 365 Security Settings: A Checklist for SMBs

Where should you start with Microsoft 365 security settings?

Start your Microsoft 365 security settings by confirming your licenses, because the plan decides which controls you can use. Business Basic, Standard and Premium (the plans were formerly sold as Office 365) all include anti-spam, anti-malware and anti-phishing protection for email. According to Microsoft 365 for business security best practices, Conditional Access, Intune Plan 1, Defender for Business and Defender for Office 365 Plan 1 come only with Business Premium.

Microsoft positions Business Premium for organizations with up to 300 users. Other plan differences are covered in our Business Basic vs Standard vs Premium comparison and on our Business Premium product page.

So an SMB on Basic or Standard can still complete the identity, email, sharing and monitoring steps. If you are planning the whole office, our SMB office IT infrastructure guide shows where this checklist fits.

Identity: security defaults or Conditional Access?

Keep security defaults on if you have no Conditional Access license; move to Conditional Access with Business Premium or Entra ID P1. The Microsoft Learn article on security defaults says they require all users to register for MFA, require admins to use MFA at every sign-in and block legacy authentication. It also states that MFA can block over 99.2% of identity-based attacks.

The two cannot be combined, so adopting Conditional Access means turning security defaults off. Build policies in report-only mode first: they are evaluated, not enforced, and the outcome lands in the sign-in log. Microsoft-managed policies also arrive in report-only mode and, unless you switch them off, are usually enabled by Microsoft after at least 30 days, with advance notice.

1. Create two emergency access (break-glass) accounts: cloud-only (*.onmicrosoft.com) Global Administrators, excluded from policies that block sign-in, protected with a FIDO2 key and tested at least every 90 days.
2. Reduce Global Administrators: Microsoft recommends fewer than five; the CISA SCuBA baselines set two to eight. Use narrower roles and separate admin accounts for daily work.
3. Require phishing-resistant MFA for admins: the built-in "Phishing-resistant MFA strength" accepts FIDO2 keys and Windows Hello for Business.
4. Enforce MFA for all users: Microsoft Authenticator asks users to type a number when approving, which makes MFA fatigue attacks harder.
5. Limit app consent: Microsoft recommends user consent only for apps from verified publishers.
6. Stop password expiry: Microsoft recommends that cloud-only passwords never expire and a 14-character minimum.

Exchange Online has already removed basic authentication for POP, IMAP, EWS and ActiveSync; SMTP AUTH is the exception. Per the Exchange Team's January 2026 update, it will be disabled by default in existing tenants at the end of December 2026, and admins can re-enable it. Inventory printers and apps that send mail this way; if you are leaving on-premises Exchange, add the list to your migration plan and compare the options in our Exchange Server end of support guide.

Baseline security mode (Settings > Org Settings > Security and Privacy in the Microsoft 365 admin center) gathers such settings on one page; Microsoft advises running each impact report first and enabling settings that show zero impact.

How do Intune and Defender for Business protect devices?

Enroll every device that touches company data in Intune, onboard it to Defender for Business and allow only compliant devices through Conditional Access. Microsoft describes Defender for Business as endpoint security based on Defender for Endpoint, built for businesses with up to 300 users.

• Compliance policy: set rules such as minimum OS version, no jailbreak or root, and a threat level. "Mark devices with no compliance policy assigned as" defaults to Compliant; Microsoft recommends Not compliant when used with Conditional Access.
• Personal devices: Intune Plan 1 includes mobile application management (MAM), so personal phones can be protected at app level.
• Defender for Business: the setup wizard grants portal access, sets email notifications, onboards Windows devices and applies default next-generation protection and firewall policies. Servers need extra licenses.

If you run a non-Microsoft product such as Bitdefender GravityZone, define each product's role first: Microsoft Defender Antivirus then runs in active, passive or disabled mode, depending on whether the device is onboarded to Defender for Endpoint. See our GravityZone packages comparison and attack surface reduction guide.

Which email security settings should be turned on?

Apply a preset security policy, complete SPF, DKIM and DMARC, and turn off automatic forwarding to external addresses. Microsoft's Standard and Strict preset policies apply anti-spam, anti-malware and anti-phishing protection with recommended settings in one step; with Business Premium they add Safe Links, Safe Attachments and impersonation protection.

Scan your domain with our email security checker once records are live; the staged rollout is described in Microsoft's DMARC guidance. In the outbound spam policy, set forwarding to Off instead of "Automatic - System-controlled": Microsoft notes the default varies by organization and that forwarding rules can be created by a compromised account. More in our Defender for Office 365 article and product page.

How should file sharing be restricted?

Set SharePoint and OneDrive external sharing to the narrowest level you need and make "Specific people" the default link. Per Microsoft's sharing documentation, OneDrive can be stricter than SharePoint but not looser, and sites cannot exceed the organization setting.

The CISA SCuBA SharePoint baseline goes further: "Existing guests" or narrower, view-only default permission and "Anyone" links expiring within 30 days. Written for US federal agencies, it is a benchmark, not an SMB requirement. Business Premium adds sensitivity labels and DLP. Sharing settings will not recover deleted or encrypted data; see our Microsoft 365 backup article.

How do audit logging and Secure Score support monitoring?

Confirm audit logging is on, then review Secure Score monthly. Microsoft Learn states that auditing is not enabled by default for Business Basic, Standard and Premium. Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled in Exchange Online PowerShell should return True; Audit (Standard) keeps records for 180 days.

In Microsoft Secure Score, each action is worth up to 10 points and some give partial credit: with 50 of 100 users on MFA, you get half the points. Security defaults earn full points on three actions: MFA for all users (9), MFA for admin roles (10) and blocking legacy authentication (7). Treat the score as a to-do list, and check emergency account sign-ins each month.

Microsoft 365 security checklist: in what order?

Apply broad, easily reversed settings first and test anything that could block users in report-only mode. The last column shows how to confirm each item.

1. Prepare: list licenses, admin roles and legacy-protocol devices; create emergency accounts; turn on auditing.
2. Identity: enable security defaults, or build Conditional Access in report-only mode and enable it after review.
3. Email and sharing: preset policies, DKIM, a p=none DMARC record, forwarding off, narrower sharing.
4. Devices and hardening: Intune and Defender for Business enrollment, compliant-device condition, DMARC at p=reject.

Create emergency accounts before Conditional Access, and require compliant devices only after enrollment, or users lose access.

FAQ

Can security defaults and Conditional Access be on at the same time?

No. Microsoft Learn says organizations that implement Conditional Access policies must disable security defaults. To avoid a protection gap, build the new policies in report-only mode, review the results in the sign-in log, then enable them and switch security defaults off. Microsoft-managed policies make the transition easier because they already cover MFA and legacy authentication blocking.

We use Business Standard. Do we need Business Premium for MFA?

No. Security defaults are available on every plan at no extra cost and enforce MFA for all users. Business Premium or Entra ID P1 becomes worthwhile when you need rules by location, device compliance or user group, or phishing-resistant MFA for administrators. Contact us to weigh the options together.

What happens to printers and apps that send email?

According to the Exchange Team's January 2026 update, basic authentication for SMTP AUTH will be disabled by default in existing tenants at the end of December 2026, and admins can re-enable it; tenants created after that will not have it by default. The final removal date is due in the second half of 2027. List these devices, check vendor OAuth support and plan alternatives such as Microsoft Graph.

If we use Bitdefender, do we also need Defender for Business?

One primary endpoint protection product keeps management simple. Microsoft Defender Antivirus runs in active, passive or disabled mode alongside a non-Microsoft antivirus, depending on whether the device is onboarded to Defender for Endpoint. Whichever product you pick, MFA, Conditional Access and email settings still have to be configured in Microsoft 365.

What is a break-glass account and how is it protected?

It is a Global Administrator account not tied to any person, kept for when normal admin accounts cannot sign in. Microsoft recommends at least two cloud-only (*.onmicrosoft.com) accounts, excluded from Conditional Access policies that block sign-in, protected with a phishing-resistant method such as a FIDO2 key, monitored for every use and tested at least every 90 days.

Conclusion

• Licensing sets the scope: security defaults on every plan, Conditional Access with Business Premium or Entra ID P1.
• Emergency accounts, MFA, blocked legacy authentication and fewer Global Administrators bring the fastest gains.
• Preset email policies, DKIM, staged DMARC and no external forwarding complete the picture.
• On SMB plans, turn audit logging on manually and review Secure Score monthly.

Sora Yazılım Teknolojileri, an Istanbul (Ataşehir) based technology company, provides Microsoft 365 license selection, procurement, deployment and support; the scope of work is defined in the contract. See our Microsoft 365 solutions.

Free discovery call · WhatsApp: WhatsApp Support · Phone: +90 544 785 21 87 · Email: talep@sorayazilim.com

Sources

1. Security defaults in Microsoft Entra ID — Microsoft Learn, 16 October 2026. learn.microsoft.com (accessed 19 October 2026)
2. Conditional Access overview; Microsoft-managed policies — Microsoft Learn, 2026. learn.microsoft.com (accessed 19 October 2026)
3. Emergency access accounts; Best practices for Microsoft Entra roles — Microsoft Learn, June 2026. learn.microsoft.com (accessed 19 October 2026)
4. Microsoft 365 for business security best practices — Microsoft Learn, 28 May 2026. learn.microsoft.com (accessed 19 October 2026)
5. Baseline security mode settings — Microsoft Learn, 30 September 2026. learn.microsoft.com (accessed 19 October 2026)
6. What is Microsoft Defender for Business? — Microsoft Learn, 2026. learn.microsoft.com (accessed 19 October 2026)
7. Device compliance policies in Microsoft Intune — Microsoft Learn, 2 July 2026. learn.microsoft.com (accessed 19 October 2026)
8. Microsoft Defender Antivirus compatibility — Microsoft Learn, 21 August 2026. learn.microsoft.com (accessed 19 October 2026)
9. DKIM, DMARC and external forwarding (Defender for Office 365) — Microsoft Learn, 2026. learn.microsoft.com (accessed 19 October 2026)
10. Manage sharing settings for SharePoint and OneDrive — Microsoft Learn, 30 June 2026. learn.microsoft.com (accessed 19 October 2026)
11. Turn auditing on or off — Microsoft Learn, 19 June 2026. learn.microsoft.com (accessed 19 October 2026)
12. Microsoft Secure Score — Microsoft Learn, 7 March 2026. learn.microsoft.com (accessed 19 October 2026)
13. Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline — Microsoft Exchange Team, 27 January 2026. techcommunity.microsoft.com (accessed 19 October 2026)
14. CISA SCuBA M365 Secure Configuration Baselines — CISA, ScubaGear 2.0.0. github.com (accessed 19 October 2026)

How this article was prepared

Prepared by: Sora Yazılım Team. This article was prepared with AI assistance; technical details were checked against the vendor and official sources linked in the text as of 19 October 2026.

Related articles

• SMB Office IT Infrastructure Setup Guide — Network, phones, email and endpoints in one plan.
• Microsoft 365 Business Basic vs Standard vs Premium — Which plan fits your team.
• Exchange Server 2016/2019 End of Support — Exchange Online or Exchange SE.
• Bitdefender GravityZone Packages Compared — Business Security, Premium and Enterprise.
• Reducing the Endpoint Attack Surface — Hardening with GravityZone.
• Ruijie Reyee or RG Enterprise Series? — Picking a network product family.
• When Does Wi-Fi 7 Make Sense for Business? — Timing a Wi-Fi refresh.
• 3CX Phone System Deployment Options — Cloud, on-premises and SIP trunk.
• 3CX and Microsoft Teams Integration — Calling via the IP PBX from Teams.