A Microsoft 365 security baseline for small and midsize organizations

A Microsoft 365 security baseline for a small or midsize organization should require MFA for every user, with phishing-resistant methods for administrators, block legacy authentication, keep admin accounts few and separate, turn on audit logging and alerts, block automatic external forwarding, and publish SPF, DKIM and DMARC records. Around that core, add Conditional Access, tighter sharing settings, an independent backup of Microsoft 365 data and device compliance, then review everything on a regular schedule.

For many small and midsize organizations, Microsoft 365 holds the things that matter most: email, files, calendars, Teams conversations and the identities that unlock all of them. That makes the tenant’s configuration one of your most important security decisions, even if nobody remembers making it.

Microsoft’s defaults have improved, but many tenants reflect years of quick fixes and exceptions nobody has revisited. This baseline describes the controls we review most often. It is a starting point rather than a promise of protection: no configuration makes a tenant immune to attack, and every change should be tested before you enforce it.

Identity: MFA for everyone, phishing-resistant where it counts

Many Microsoft 365 compromises start with a stolen password or a stolen session. Multifactor authentication (MFA) is one of the most effective controls in this list, and the method you choose matters.

• Require MFA for every user, including administrators, executives and anyone who works remotely
• Prefer an authenticator app with number matching over text messages and voice calls, which are easier to intercept
• Use phishing-resistant methods, such as passkeys, hardware security keys, Windows Hello for Business or certificate-based authentication, for administrators and high-risk roles like finance
• Review the MFA methods registered to each account and investigate any you do not recognize
• Block interactive sign-in for shared mailboxes and service accounts that do not need it

Phishing-resistant methods are tied to the legitimate sign-in site, so a convincing fake page cannot simply relay the user’s approval to the attacker.

Conditional Access: who can sign in, from where, on what

Conditional Access policies let you set rules for sign-ins rather than relying on a single on-or-off switch. If your licensing does not include Conditional Access, Microsoft’s security defaults provide a basic, tenant-wide MFA baseline and should be turned on.

• Require MFA for all users and all cloud apps as the foundation policy
• Block legacy authentication protocols, which cannot enforce MFA
• Require stronger authentication methods for administrator roles
• Require managed devices that meet your device compliance policy for access to sensitive data
• Add sign-in risk and user risk conditions where your licensing supports them
• Start new policies in report-only mode, review the impact, then enforce
• Exclude emergency access accounts deliberately, document why, and monitor every sign-in to them

Retire legacy authentication

Older protocols send a username and password with each request and cannot prompt for MFA. Microsoft has been retiring basic authentication across Exchange Online, but older multifunction printers, scanners, line-of-business applications and scripts can still depend on legacy methods such as SMTP AUTH.

Inventory what still uses them, move each one to modern authentication or a dedicated relay option, and then block legacy authentication for everyone else.

Admin role hygiene

An administrator account is the most valuable account in the tenant. Treat it that way.

• Keep the number of Global Administrators small, but have more than one so you cannot lock yourself out
• Give administrators separate admin accounts that are never used for email, browsing or daily work
• Assign the least-privileged role that does the job, such as Exchange, User or Helpdesk administrator, instead of Global Administrator
• Use just-in-time elevation, such as Privileged Identity Management, where your licensing supports it
• Maintain emergency access accounts with strong, phishing-resistant protection, stored securely and monitored
• Review role assignments regularly and every time someone changes jobs or leaves
• Review delegated administration relationships with outside providers and remove any that are no longer needed

Auditing, logging and alert policies

When something goes wrong, logs are how you find out what happened. They only help if they are turned on, kept long enough and actually reviewed.

• Confirm that unified audit logging is turned on for the tenant
• Confirm that mailbox auditing is active; it is on by default for most mailboxes, but verify it
• Know how long your plan retains audit logs, and export them to longer-term storage if that is not long enough for your needs
• Review the built-in alert policies, such as alerts for new forwarding rules, elevated admin privileges and unusual sending activity, and make sure alerts reach someone who will act
• Review risky sign-ins and users flagged at risk, where your licensing provides those reports

Logs that nobody reviews do not stop an attacker. If no one on your team watches these signals outside business hours, managed detection and response with 24/7 security monitoring can close that gap.

Control external forwarding and inbox rules

In Business Email Compromise, attackers often create rules that forward copies of mail outside the organization or hide replies from the real user. A few settings make this much harder:

• Block automatic forwarding to external addresses in your outbound policy, and allow specific exceptions only when there is a business need
• Alert on new inbox rules and forwarding changes, especially rules that delete messages or move them to rarely used folders
• Periodically review mailbox forwarding settings across the tenant

Email authentication: SPF, DKIM and DMARC

These three DNS-based standards help receiving mail systems tell real messages from your domain apart from forgeries. SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message. DMARC tells receivers what to do when a message fails those checks and sends you reports about who is sending as your domain.

• Publish an SPF record that includes every legitimate sender, such as marketing, billing and CRM platforms, and stays within DNS lookup limits
• Turn on DKIM signing for each custom domain in Microsoft 365
• Start DMARC in monitoring mode with reporting, fix any legitimate senders that fail, then move to quarantine and eventually reject
• Protect domains that never send email with records that tell receivers to reject anything claiming to come from them

DMARC protects your exact domain from being spoofed. It does not stop lookalike domains, which is why user awareness and payment verification still matter.

Use the built-in protection and the security score

Microsoft 365 includes filtering for spam, malware and phishing, and some plans add link scanning and attachment detonation. Microsoft’s preset security policies apply recommended settings in one step and are a sensible starting point for most organizations.

Microsoft also provides a security score that compares your configuration with its recommendations. Treat it as a prioritized to-do list rather than a grade, and document any recommendation you deliberately decide not to follow.

Tighten sharing in SharePoint, OneDrive and Teams

• Set organization-wide external sharing to the least permissive level that still supports how you work
• Make sharing with specific people the default link type, rather than links anyone can open
• If you allow anyone links, set them to expire and default them to view-only
• Review guest accounts and remove those that are no longer needed
• Use sensitivity labels for confidential information where your licensing includes them

Back up Microsoft 365 data

Microsoft keeps the service running and offers retention features and recycle bins, but those are not the same as an independent backup that you control. Under the shared responsibility model, protecting your data from deletion, ransomware or a malicious insider is largely your job. If you would rather not run Microsoft 365 backups yourself, Atlantic Computer Systems, our parent company, provides managed cloud and backup services.

• Back up Exchange Online, OneDrive, SharePoint and Teams data to copies stored separately from your production tenant
• Protect backup administration with MFA and dedicated accounts
• Set retention that matches your business, contractual and regulatory needs
• Test restores of a mailbox, a site and individual files on a regular schedule, and record the results

Device compliance

Strong identity controls are weaker if the device signing in is unmanaged or out of date.

• Enroll company devices in a device management service, such as Microsoft Intune
• Define compliance policies covering disk encryption, operating system updates, screen lock and endpoint protection
• Use Conditional Access to require managed devices that meet those policies for sensitive applications
• Use app protection policies to keep company data contained on personal phones

Set a review cadence

A baseline drifts as people join and leave, apps are added and exceptions pile up. A simple schedule keeps it current:

When	What to review
Continuously	Security alerts, risky sign-ins and new forwarding or inbox rules
Monthly	Security score recommendations, MFA registration gaps, guest accounts and sharing links
Quarterly	Admin role assignments, Conditional Access policies and exclusions, app consents and delegated admin relationships
Annually	The full baseline, a restore test, DMARC status and your written security policies
After any major change	Staff departures, new applications, acquisitions or a security incident

If an account has already been compromised

A baseline lowers risk; it does not undo a compromise already in progress. If you see unfamiliar sign-ins, inbox rules nobody created or MFA prompts nobody requested, treat it as an incident: reset the password from a trusted device, revoke active sessions, check for MFA methods nobody recognizes, document suspicious rules before disabling them and call our 24/7 incident line at 1-650-300-7557.

Our page on phishing and hacked email or Microsoft 365 accounts explains how we contain the account, find out what the attacker accessed and harden the tenant afterward. If a payment may be involved, start with our guide to the first hour of a suspected BEC incident. Not sure whether an account is compromised? Use our warning signs and self-check.

Where to start

If you can only do a few things this month, start with MFA for everyone, phishing-resistant sign-in for administrators, blocked legacy authentication, blocked external forwarding, audit logging and a review of admin roles. Then work through the rest of the list.

If you would like help, our advisory and vCISO services include Microsoft 365 security strategy, our vulnerability management service includes configuration reviews, and our MDR service monitors Microsoft 365 activity around the clock. To talk through your tenant, book a free 30-minute consultation with our security team.

Because our parent company, Atlantic Computer Systems, provides managed IT including Microsoft 365 administration, the changes we recommend can be carried through in your tenant. Learn about Atlantic Computer Systems.