Microsoft 365 security checklist: a practical baseline for SA small businesses and councils

Most South Australian small businesses, not-for-profits and councils now run their email, files, chat and calendars in Microsoft 365. That makes the Microsoft 365 tenancy one of the most valuable things you own, and one of the most common ways attackers get in: a stolen password, an approved MFA prompt, a hidden mailbox forwarding rule, or a document shared with “anyone with the link”. Microsoft secures the platform, but how your tenancy is configured is your responsibility. This guide sets out a practical security baseline you can work through with a small team or an IT provider. It is general guidance; Microsoft features, licence names and admin portals change often, so check current details for your own plan.

Who is responsible for what

Microsoft runs the data centres, the software and the core service. You (or your IT provider) decide who can sign in, how, from which devices, what can be shared and with whom, which apps can reach your data, and whether anyone is watching the logs. Most Microsoft 365 incidents in small organisations come from settings left at a weak value or never reviewed, not from a failure at Microsoft. A baseline turns those settings into a short list of deliberate decisions you can explain to an insurer, a government buyer or an auditor.

Step 1: protect the admin accounts first

• Separate admin accounts. People who administer the tenancy should use a separate admin account that has no mailbox and is not used for everyday email or browsing.
• Keep Global Administrators to a minimum. Microsoft recommends fewer than five. Give everyone else a narrower role, such as User Administrator, Exchange Administrator or Helpdesk Administrator.
• Two emergency access accounts. Keep two “break-glass” Global Administrator accounts with long, securely stored credentials, excluded from risky lock-out policies but monitored, so a misconfigured policy can’t lock everyone out.
• Strongest MFA for admins. Admin accounts should use phishing-resistant methods such as passkeys or FIDO2 security keys.
• Know who your provider is. Check which partners and resellers have delegated admin access to your tenancy, and remove any you no longer use. Our domain, DNS and admin account ownership checklist covers who should hold the keys.

Step 2: MFA for everyone, and block old sign-in methods

Multi-factor authentication stops most password attacks, but only if it covers every account and old protocols can’t bypass it.

• Security defaults or Conditional Access. Tenancies without Microsoft Entra ID P1 (included in Microsoft 365 Business Premium and E3/E5 plans) should at least turn on security defaults, which require MFA registration and block legacy authentication. With P1 you can use Conditional Access policies instead, which give finer control. You use one or the other, not both.
• Use number matching or passkeys in the Microsoft Authenticator app rather than SMS or simple approve prompts, and teach staff never to approve a sign-in they didn’t start. Higher Essential Eight maturity levels expect phishing-resistant MFA.
• Block legacy authentication. Older protocols that only send a username and password can sidestep MFA. Exchange Online has already switched off basic authentication for most protocols. The remaining exception, SMTP AUTH used by some printers, scanners and line-of-business apps to send email, is due to be disabled by default for existing tenancies at the end of December 2026, with Microsoft to announce a final removal date in 2027. Find those devices now using the SMTP AUTH report in the Exchange admin center and move them to a supported method.
• Shared and service accounts need an owner, MFA or a documented exception, and a password manager rather than a sticky note. See our password manager and MFA rollout guide.

Step 3: email protection

• Turn on the preset security policies. Exchange Online Protection is included in every plan. If you have Microsoft Defender for Office 365 (Plan 1 is included in Business Premium), apply the Standard or Strict preset policies so Safe Links, Safe Attachments and impersonation protection are on for everyone, rather than hand-tuning dozens of settings.
• Block automatic forwarding to external addresses. Attackers who get into a mailbox often add a rule that quietly copies invoices and payment emails to an outside address. Keep external auto-forwarding blocked in the outbound spam policy, and allow named exceptions only when there is a business reason.
• Protect your domain. Publish SPF, DKIM and DMARC so criminals can’t easily send email as you. Our SPF, DKIM and DMARC guide sets out a safe path.
• Make reporting easy. Turn on the built-in Report button in Outlook and tell staff where reported messages go and who reviews them.

Step 4: sharing in SharePoint, OneDrive and Teams

• Set the external sharing level on purpose. Decide whether staff can share with “anyone”, with new and existing guests, only with existing guests, or only inside the organisation, and set sensitive sites (finance, HR, rates, case files) more tightly than the default.
• Change the default link type to “people in your organisation” or “specific people”, and if you allow “anyone” links, set them to expire.
• Review guest access in Teams and SharePoint at least every quarter and remove guests who no longer need it.
• Fix oversharing before AI. Microsoft 365 Copilot and other AI assistants can surface anything a user already has access to. Tidy permissions first; see our Copilot readiness guide. If you are still moving off a file server, the SharePoint and OneDrive migration guide shows how to design permissions from the start.
• Label what matters. Where your plan includes Microsoft Purview, sensitivity labels can mark and protect confidential documents and emails. Start with three or four labels staff can understand.

Step 5: apps, devices and sign-in conditions

• Stop users consenting to unknown apps. Restrict user consent to verified publishers or low-risk permissions and set up the admin consent workflow, so a phishing email can’t trick a user into granting a malicious app access to their mailbox. Review existing enterprise apps and their permissions.
• Manage devices. Enrol laptops and phones in Intune, set compliance rules (supported operating system, encryption, screen lock, updates), and where you have Conditional Access, require a compliant device or app protection for access to company data. See our Intune and BYOD guide.
• Use location and risk conditions sensibly. Blocking sign-ins from countries you never work from can reduce noise, but it is not a substitute for MFA. Government and council teams moving further should read our Zero Trust and Conditional Access guide.

Step 6: logging, alerts and someone who reads them

• Check that audit logging is on. Microsoft Purview audit is on by default for most tenancies, but confirm it, and note how long your plan keeps records (about 180 days on standard plans at the time of writing). Export or retain longer if your obligations need it.
• Alerts that reach a person. Make sure alerts for things like new forwarding rules, suspicious sign-ins, mass downloads and admin role changes go to a monitored mailbox or your IT provider, not an unread admin inbox.
• Use Microsoft Secure Score as a to-do list, not a target. Secure Score in the Microsoft Defender portal lists recommended settings for your tenancy. Work through the high-impact items, record why you accept any you don’t action, and review it monthly.

Step 7: back up Microsoft 365 data

Microsoft keeps the service running, but recycle bins and retention settings only hold deleted content for limited periods and are not designed as a backup you control. If ransomware encrypts synced files, a staff member deletes a site, or a departing user’s mailbox is removed, you need a separate backup of Exchange, OneDrive, SharePoint and Teams data, from Microsoft 365 Backup or a third-party product, with restores tested. Our backup and disaster recovery guide explains recovery targets and testing.

Step 8: joiners, leavers and regular reviews

• Disable accounts and revoke sessions on a person’s last day, convert or retain the mailbox as your records rules require, and recover devices. Our onboarding and offboarding checklist lists the steps.
• Each quarter, review admin roles, guests, external sharing, enterprise apps, forwarding rules and licences. Unused licences and accounts are both a cost and a risk; see our Microsoft 365 licence review guide.

How this maps to the Essential Eight and insurer questions

A Microsoft 365 baseline covers several of the Australian Signals Directorate’s Essential Eight strategies directly: multi-factor authentication, restricting administrative privileges, regular backups and user application hardening, plus parts of patching through device management. ASD also publishes the Blueprint for Secure Cloud, which includes detailed Microsoft 365 configuration guidance. The same controls are what cyber insurance questionnaires and council or government supplier questionnaires usually ask about. See our Essential Eight guide and cyber insurance questionnaire guide.

Councils, not-for-profits and SA Government suppliers

• Councils often hold rates, planning, library and customer records in SharePoint and Exchange. Record retention and FOI obligations affect how you delete mailboxes and sites, so agree the rules with your records team before automating offboarding.
• Not-for-profits using donated or discounted Microsoft licences should check which security features their plan includes; some protections need Business Premium or an add-on.
• Suppliers to SA Government agencies may be asked how their tenancy aligns with the SA Government’s Cyber Security Framework or the Essential Eight. A written baseline and a recent Secure Score export are simple evidence.

A practical 30-day plan

1. Week 1: list admin accounts and roles, create two emergency access accounts, move admins to separate accounts with phishing-resistant MFA, and remove partner access you no longer need.
2. Week 2: confirm MFA coverage for every user, turn on security defaults or Conditional Access, block legacy authentication, and find devices still using SMTP AUTH.
3. Week 3: apply the email preset security policies, block external auto-forwarding, set SharePoint and OneDrive sharing levels and default links, and restrict app consent.
4. Week 4: check audit logging and alert routing, start a Microsoft 365 backup and test a restore, export Secure Score, and write a one-page baseline with a quarterly review date.

Questions to ask your IT provider

• How many Global Administrators do we have, and do we have emergency access accounts?
• Is MFA enforced for every account, including shared and service accounts, and is legacy authentication blocked?
• Which of our devices or apps still send email using SMTP AUTH, and what is the plan before it is disabled?
• Who receives Microsoft 365 security alerts, and how quickly are they looked at?
• Is our Microsoft 365 data backed up outside Microsoft’s own retention, and when did we last test a restore?
• What is our current Secure Score, and which recommendations have we chosen not to action?

If an account is compromised, follow your cyber incident response plan: reset the password, revoke sessions, check for new forwarding rules and app consents, and review what was accessed.

Microsoft 365 is only half the picture; our office network, Wi-Fi and firewall checklist covers the office and site network.

Talk to an Adelaide team

EITSAA provides managed IT and cyber security for SA small businesses, not-for-profits and councils, including Microsoft 365 security reviews, Essential Eight uplift and ongoing monitoring. Get a quote for a Microsoft 365 security review or call 0402 401 584, Monday to Friday, 9am to 5:30pm. We can quote a short review of your tenancy that produces a prioritised baseline and a 30-day plan you can use with any supplier. Learn more about our managed IT and cyber security and training and consultations services.