10 Microsoft 365 security quick wins

A practical 10-point Microsoft 365 security checklist for organisations of about 15 to 200 staff: what to check, where to find it, and what to test before you change it.

Microsoft 365 ships with strong security controls, but relevant controls may not be fully configured or consistently enforced. These ten checks cover common gaps for an organisation of about 15 to 200 staff. Each item says where to check it, which licence it needs, and when to test a change before rolling it out. Here's what the checklist covers.

Where the quick wins are

• Identity: MFA for every account and a Conditional Access baseline, rolled out in report-only mode first.
• Admin: fewer Global Admins, tested emergency access accounts, and partner access you can see.
• Posture: Secure Score and Microsoft's Baseline security mode, reviewed regularly.
• Email: anti-phishing protection, plus SPF, DKIM and DMARC for your domain.
• Devices, sharing and apps: Intune and Defender for Business, deliberate external sharing, and control over app consent.
• Visibility and recovery: audit logging and log retention, and a backup you have test-restored.

Many foundational controls are available within commonly used Microsoft 365 plans, but feature availability varies by licence, tenant configuration and workload. Capabilities such as Privileged Identity Management, advanced Defender functions, automated labelling and some Purview controls may require additional licensing. Confirm entitlements before implementation. Ordering the steps by impact lets you address the high-value items first and evidence the change in your Secure Score.