The 10-Minute Microsoft 365 Security Checklist Every Business Should Run

Most Microsoft 365 tenants we audit are running with critical security features disabled — not because businesses don't care, but because M365 ships with them off. Here's what to turn on right now.

Why Your M365 Tenant Is Probably Insecure Right Now

Microsoft 365 ships with most of its security features turned off by default. This isn't a flaw — it's a design choice to make initial setup easier. But it means the average business that signed up for M365, set up email, and moved on is running an environment with significant security gaps.

The following checklist covers the most critical settings. Most can be enabled in under 10 minutes total. None require a security background to implement.

Before you start: You need Global Administrator access to your Microsoft 365 tenant. Log in at admin.microsoft.com. Keep this page open — most settings are found in the Microsoft 365 Admin Center or the Microsoft Entra admin center (entra.microsoft.com).

The 10-Minute Security Checklist

Identity & Access (Most Critical)

• Enable MFA for all users. Go to Microsoft Entra admin center → Identity → Users → All users → Per-user MFA. Enable for every account, especially admins. This single step blocks over 99% of account compromise attacks.
• Enable Security Defaults or Conditional Access. In Entra admin center → Identity → Overview → Properties → Manage Security Defaults. If you're not using Conditional Access policies yet, Security Defaults provides baseline protection automatically.
• Review admin accounts. In Entra admin center → Roles → Assignments. You should have as few Global Admins as possible — ideally 2–3 named accounts. Remove any service accounts or shared accounts from admin roles.
• Enable Self-Service Password Reset. In Entra admin center → Identity → Users → Password reset. This reduces helpdesk burden and keeps users from sharing passwords with IT staff.

Email Security

• Enable Anti-Phishing policy. In Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Anti-phishing. Enable impersonation protection for your domain and key executives.
• Enable Safe Links & Safe Attachments. Same location — Threat policies → Safe Links and Safe Attachments. These scan links and attachments in real time before delivery. Should be on for all users.
• Check your SPF, DKIM, and DMARC records. In Microsoft 365 Admin Center → Settings → Domains → click your domain → DNS records. Verify SPF is set, DKIM is enabled (under Defender → Email authentication), and DMARC is configured in your DNS.
• Enable Audit Logging. In Microsoft Purview compliance portal → Audit → Start recording user and admin activity. Required for incident response and compliance — off by default.

Data Protection

• Review external sharing settings in SharePoint. In SharePoint admin center → Policies → Sharing. Set external sharing to "New and existing guests" at most — not "Anyone." Unrestricted sharing means any shared link works forever for anyone with it.
• Enable Microsoft Defender for Business. In Microsoft 365 Admin Center → Security — if included in your plan, onboard all devices to Defender. This provides endpoint detection and response across all company devices.

After the 10 Minutes: What Comes Next

These settings get you to a solid baseline. The next layer of security involves Conditional Access policies (blocking sign-ins from risky locations or unmanaged devices), Intune device enrollment and compliance policies, Microsoft Purview data loss prevention rules, and privileged identity management for admin accounts.

A full security hardening engagement typically takes 1–2 days and results in a documented security posture with policies tailored to your business — not just defaults.

Quick win: Run the Microsoft Secure Score assessment at security.microsoft.com → Secure Score. It gives you a prioritized list of recommendations specific to your tenant, scored by impact. Most tenants score below 40% when we first audit them. The checklist above should get you to 60%+ immediately.

Related Articles