A Microsoft 365 security baseline is the minimum set of settings you would expect to find in every tenant, however small the company. This Microsoft 365 security checklist covers 21 of them in plain language, grouped by area: sign-in, administrator accounts, email, devices, sharing, backup and logging, and how often to look again. Each item says what to check and why it matters.
It assumes you already use Microsoft 365 and want to know whether the basics are in place. If you are still deciding which cloud model to use, start with our cloud services planning guide, which this page does not repeat. What follows is general guidance, not an audit, and it makes no promise about outcomes.
What a baseline is, and how to use this checklist
A baseline is not a certificate and it is not a score. It is a short list of security best practices turned into decisions your company has made on purpose: who can sign in and how, who can administer the tenant, what leaves the company by email or sharing, and what you could investigate or recover after an incident. Writing them down matters as much as the settings, because a setting nobody remembers choosing tends to drift.
Work through the list in order. Items 1 to 8 come first because compromised accounts are a common starting point. Some controls depend on your licence, and Microsoft publishes licensing guidance that shows which services need which subscription (see Sources); we do not list licence differences here because they change. For how the Business plans differ, see our guide to Microsoft 365 Business Basic vs Standard vs Premium. For each item, record one of four answers in your own tenant: done, partly done, not applicable or not known. Treat “not known” as a gap to close.
Identity and multi-factor authentication
Sign-in is the front door, so these four items come first.
- Require multi-factor authentication (MFA) for every user. Include part-time staff, contractors and service-desk accounts, not only the office team. Why it matters: a stolen or guessed password is then not enough to sign in. Microsoft lists MFA registration for all users among the basic controls of its security defaults.
- Block legacy authentication. Older protocols and clients, such as IMAP, POP3 and old Office versions, cannot use MFA. First find out what still depends on them: scanners, line-of-business apps, old mail clients. Why it matters: Microsoft states that legacy authentication does not support MFA, so an attacker can use it to bypass the check.
- Make the Microsoft Authenticator app the main method. Security defaults ask users to register for Authenticator notifications, and codes from other authenticator apps also work. Do not switch off methods while security defaults are on. Why it matters: the notification shows a number the user must enter, which Microsoft says helps against MFA fatigue, where someone approves a request they did not start.
- Choose security defaults or Conditional Access, and write down which. Security defaults are preconfigured, on-or-off settings with no extra licence. Conditional Access allows rules by user, location, device or app and needs at least Microsoft Entra ID P1 (check current licensing). If you replace one with the other, disable security defaults and enable your policies straight away. Why it matters: a tenant half-way between the two can leave gaps nobody notices.
Administrator accounts and privileged access
Administrators can change tenant-wide settings, so one compromised admin account does far more damage than an ordinary one.
- Give administrators a separate account. The account used for email and browsing should not be the one that holds admin roles. Microsoft’s security defaults page makes the same recommendation. Why it matters: an admin who reads email all day is exposed to every phishing message that person receives.
- Require MFA on admin sign-ins, with no shared admin accounts. Every administrator should sign in as a named person, so actions can be traced. Why it matters: shared credentials make it impossible to tell who changed what.
- Keep administrators few, and give each the narrowest role that works. Count how many accounts hold Global Administrator and justify each one. Exchange, SharePoint and helpdesk roles often do the job. Why it matters: fewer powerful accounts means fewer to protect and review.
- Create at least two emergency access accounts. Use long unique passwords, store them securely, keep them out of daily use and test them occasionally. Plan carefully how they are excluded from policies. Why it matters: a mistaken policy or a lost phone should not lock every administrator out of the tenant.
Email protection
Email is a common route for phishing and invoice fraud, and a compromised mailbox can be used against your customers too.
- Publish SPF, DKIM and DMARC records for every domain you send from. Start DMARC in monitoring mode, read the reports, then tighten. Why it matters: these records help receivers reject forged mail that claims to come from your domain. Our SPF, DKIM and DMARC guide shows the steps.
- Review automatic forwarding to external addresses. Look for inbox rules and mailbox settings that forward mail outside the company, and decide whether to allow them. Why it matters: a hidden forwarding rule can be a sign of a compromised account and sends mail out silently.
- Turn on anti-phishing and attachment or link protection, depending on your licence. Check what your plan includes, confirm it is enabled and decide who reviews quarantined messages. Why it matters: filters that are included but switched off protect nobody.
Devices and apps
- Keep an inventory of the devices that open company data. Include phones and personal devices used for email. Require a screen lock, current updates and disk encryption, using Intune or another management tool where your licence allows. Why it matters: a lost laptop is then less likely to turn into a data breach.
- Remove devices and access when people leave. Use an offboarding checklist: disable the account, revoke sessions, recover or wipe devices, review shared mailboxes and groups. Why it matters: former staff should not keep access through a phone nobody remembers. For the full joiner and leaver steps, see our IT onboarding and offboarding checklist.
Sharing, guests and data
- Decide your external sharing settings deliberately. Microsoft notes that external sharing is on by default for the whole SharePoint and OneDrive environment, though not every new site allows it. Set the organisation level, then tighten individual sites; where settings differ, the most restrictive one applies. Why it matters: the default may be wider than your policy.
- Prefer named guests over “Anyone” links for sensitive content. Keep confidential material in sites with external sharing turned off. Why it matters: Microsoft describes “Anyone” links as unauthenticated sharing, so anyone who obtains the link may be able to open the file.
- Review guest accounts and group memberships on a schedule. Remove guests whose project has ended and confirm who owns each team. Why it matters: old guest access accumulates quietly and is rarely missed.
Backup, retention and logging
Backup and retention
- Keep a backup of Microsoft 365 data that you control. Recycle bins and version history help with accidental deletion, but retention windows are limited and differ by service and licence. Our backup and recovery guide covers RPO, RTO and 3-2-1. Why it matters: high availability is not the same as a recoverable copy.
- Test a restore of a mailbox and a document library at least once a year. Record how long it took and what failed. Why it matters: a backup that has never been restored is an assumption.
Logging and alerts
- Check that audit logging is on. Microsoft says auditing is on by default for Microsoft 365 organisations but not for small and medium business licences such as Business Basic, Standard and Premium, so verify it and check the current Microsoft documentation. When enabled, retention is typically 180 days at the time of writing, depending on retention policies and licence; check the current Microsoft documentation. Why it matters: without audit records, “who did what and when” is hard to answer after an incident.
- Decide who receives security alerts and who acts on them. Send alerts to a monitored group, not one person’s inbox, and agree what happens next. Why it matters: an alert that nobody reads has no value.
Review cadence: keeping the baseline current
- Put a recurring review in the calendar. Look at Microsoft Secure Score monthly as a trend, not a target; Microsoft says not every recommendation suits every environment and lets you accept a risk. Review the admin list, guests, forwarding rules and sharing each quarter, and repeat the restore test and this checklist each year. Why it matters: tenants change whenever people, apps and licences change, and a baseline only helps if it is kept up to date.
Assign a named owner in management, who accepts the risks left open. If NIS2 may apply to you, our NIS2 guide for SMEs shows how these controls connect to the directive. This is general information, not legal advice, and following it does not guarantee compliance; check the current directive and your national law.
What we typically review first
BlueNova IT is based in Tallinn and works with small and midsize companies across Europe, with support in English and Spanish, Monday to Friday, 09:00-18:00 CET. When we review a Microsoft 365 tenant for a client, we usually look at the same areas first, in this order:
- How people sign in: MFA coverage and any remaining legacy protocols.
- Who administers the tenant: admin roles, shared accounts and emergency access.
- Email: domain authentication and external forwarding rules.
- Sharing: external sharing settings and guest accounts.
- Evidence and recovery: whether auditing is on, who sees alerts and what is backed up.
The outcome is a written, prioritised list of gaps for you to decide on. Scope is agreed with each organisation, and we do not promise results or response times. If you want help applying a baseline, see our Cloud and Microsoft 365 and cybersecurity services, or contact us. BlueNova IT does not claim Microsoft vendor status; product names appear here only to describe settings.
Sources
- Microsoft Learn: Security defaults in Microsoft Entra ID: basic controls, authentication methods, separate admin accounts and the comparison with Conditional Access
- Microsoft Learn: Microsoft Secure Score: how the score and its recommended actions work
- Microsoft Learn: Turn auditing on or off: default auditing status, retention and the small-business licence exception
- Microsoft Learn: Overview of external sharing in SharePoint and OneDrive: default settings, organisation and site levels, and sharing links
- Microsoft Learn: Microsoft 365 security licensing guidance: licensing guidance and links to the service descriptions
Related: Cloud and Microsoft 365, cybersecurity services, Choosing cloud services: SaaS, PaaS and IaaS compared, Backup and recovery for business: RPO, RTO and the 3-2-1 rule, NIS2 for SMEs: what it means and the first steps to take.
