How to Secure Microsoft 365: A Settings Checklist for Admins

Most Microsoft 365 tenants aren’t breached through some exotic zero-day. They’re breached through a reused password on an account without MFA, an old email protocol that skips MFA entirely, or a forwarding rule an attacker quietly set up in someone’s mailbox. The fixes for all three are settings you already own.

The catch is that Microsoft spreads those settings across several portals: the Microsoft 365 admin center, the Microsoft Entra admin center, the Microsoft Defender portal, the SharePoint admin center and the Microsoft Purview portal. This checklist puts them in priority order and tells you where each one lives, so you can work through it in an afternoon.

Menu names change often in Microsoft portals. If a path below doesn’t match your screen exactly, search the setting name in the portal’s search box.

The 5 admin portals you’ll use

Before you start, bookmark these. You need an admin role in each, and you’ll sign in with MFA (Microsoft began requiring MFA for the Microsoft 365 admin center in February 2025).

Lock down sign-ins first

Identity is where most Microsoft 365 compromises start, so the first 3 steps all deal with how people sign in.

Step 1: Turn on MFA for every account

MFA is the single most important setting in this list. Microsoft states that MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks.

You have 2 ways to turn it on, and you can’t use both at once.

Security defaults are free and work on every plan. They require all users to register for MFA, require MFA for admin roles every time they sign in, block legacy authentication and block device code flow. Microsoft recommends them for organizations without Microsoft Entra ID P1 or P2 licenses.

• Where: Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults > set to Enabled.

Conditional Access needs at least Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3/E5 plans. It lets you build rules such as “require MFA for everyone, but require a compliant device for admins.” If you switch to it, turn off security defaults and immediately turn on replacement policies. Microsoft offers managed policies that recreate the security defaults protections.

• Where: Microsoft Entra admin center > Entra ID > Conditional Access > Policies. Start from the templates in the secure foundations category.

Whichever you use, push staff toward the Microsoft Authenticator app or passkeys rather than text messages. Our guide to passkeys and the end of passwords explains why phishing-resistant sign-in is the direction everything is heading.

Key takeaway: If you do nothing else this week, turn on security defaults or a Conditional Access MFA policy. Every other setting on this list matters less than this one.

Step 2: Lock down admin accounts

Attackers want admin accounts because one of them can change everything else.

• Keep Global Admins to fewer than 5. That’s Microsoft’s own recommendation. Give people narrower roles, such as User Administrator, Exchange Administrator or Helpdesk Administrator, for day-to-day work.
• Where: Microsoft 365 admin center > Roles > Role assignments.
• Use separate admin accounts. Admins should read email and browse on a normal account, and sign in to an admin-only account only when needed.
• Create 2 emergency access accounts. Microsoft recommends 2 cloud-only “break glass” accounts permanently assigned the Global Administrator role, stored securely and used only if every other admin is locked out.
• Review roles quarterly. Remove anyone who changed jobs or left.

Step 3: Block legacy authentication

Legacy authentication means older protocols such as POP3, IMAP and basic-auth SMTP, plus very old Office clients. They don’t support MFA, so an attacker with a stolen password can walk straight past your MFA policy.

• Security defaults block legacy authentication automatically.
• With Conditional Access, create a policy that blocks the Exchange ActiveSync clients and Other clients client app types. Microsoft provides a template for this.
• Check first: in the Entra admin center, open Sign-in logs and filter by client app to see who still uses old protocols. Printers and scanners that “scan to email” are the usual culprits.

Microsoft is also retiring basic authentication for SMTP AUTH, the method many copiers and line-of-business apps use to send mail. Its latest published timeline, updated in January 2026, says basic auth for SMTP AUTH will be disabled by default for existing tenants at the end of December 2026, with a final removal date to be announced later. Move those devices to OAuth or a supported relay option now.

Harden email

Step 4: Apply preset email security policies

Email is still the main way attackers get in, through phishing links, malicious attachments and fake invoices. Microsoft’s preset security policies apply its recommended anti-spam, anti-malware and anti-phishing settings in one step, so you don’t have to tune dozens of options yourself.

• Where: Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset security policies (direct link: security.microsoft.com/presetSecurityPolicies).
• Turn on Standard protection for most users. Consider Strict protection for executives, finance staff and anyone who approves payments.
• If you have Defender for Office 365 licenses, the same presets add Safe Links, Safe Attachments and impersonation protection. A Built-in protection preset gives basic Safe Links and Safe Attachments coverage by default.

Next, protect your domain from being spoofed. Publish SPF, DKIM and DMARC records for every domain you send from. Our guide to SPF, DKIM and DMARC walks through each record and how to reach DMARC enforcement safely.

Step 5: Turn off automatic external forwarding

When attackers take over a mailbox, a common first move is a hidden inbox rule that forwards everything to an outside address. Blocking automatic external forwarding stops that leak, even if a password is stolen.

• Where: Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam > open the outbound policy > Protection settings > Automatic forwarding rules.
• Set it to Off - Forwarding is disabled. Microsoft advises picking On or Off explicitly instead of leaving Automatic - System-controlled, because that default behaves differently in different tenants.
• If someone genuinely needs to forward to an outside address, allow it narrowly using a custom policy or remote domain settings in the Exchange admin center.
• Check the Auto forwarded messages report in the Exchange admin center to see who is forwarding today.

Protect files, apps and logs

Step 6: Tighten sharing in SharePoint and OneDrive

Overshared files are a quiet risk, and they matter more once AI assistants can search everything a user has access to. If you’re weighing Copilot, read whether Microsoft 365 Copilot is worth it after you fix sharing.

• Where: SharePoint admin center > Policies > Sharing.
• Choose the most restrictive level that still lets people work. The options are Anyone, New and existing guests, Existing guests and Only people in your organization. The OneDrive setting can be the same or stricter than SharePoint, never looser.
• If you allow Anyone links, set them to expire and to give view-only access by default.
• Set the default link type to Specific people or Only people in your organization.
• Turn on guest access expiration so outside collaborators don’t keep access forever.

Step 7: Control which apps users can connect

Consent phishing tricks a user into approving a malicious app that then reads their mail or files, without ever needing a password. By default, users can consent to apps for permissions that don’t need admin approval.

• Where: Microsoft Entra admin center > Identity > Applications > Enterprise apps > Consent and permissions > User consent settings.
• Microsoft recommends allowing user consent only for apps from verified publishers, for low-impact permissions. Smaller teams often turn user consent off entirely and enable the admin consent workflow so staff can request apps.

Step 8: Confirm audit logging is on

When something goes wrong, the audit log is how you find out what happened. Microsoft says audit logging is on by default for most organizations, but not for small-business plans, including Business Basic, Business Standard and Business Premium. Those tenants must turn it on manually.

• Where: Microsoft Purview portal > Audit. If you see a banner offering to Start recording user and admin activity, auditing is off. Select it. It can take up to 60 minutes to start.
• Standard audit retention is 180 days.

Step 9: Work through Secure Score

Microsoft Secure Score lists recommended actions across Entra ID, Exchange Online, Teams, SharePoint and Defender, with points for each one you complete. It’s the easiest way to find what this checklist didn’t cover in your specific tenant.

• Where: Microsoft Defender portal > Secure Score (direct link: security.microsoft.com/securescore).
• Turning on security defaults earns full points for several MFA and legacy authentication actions at once.
• Treat it as a to-do list, not a grade. A high score doesn’t guarantee you can’t be breached.

Where to start this week

If you have limited time, do the checklist in this order:

1. Day 1: Turn on security defaults or a Conditional Access MFA policy. Tell staff in advance so registration goes smoothly.
2. Day 1: Count your Global Admins and reduce them. Create 2 emergency access accounts.
3. Day 2: Check sign-in logs for legacy authentication, fix scanners and apps, then block it.
4. Day 2: Turn on the Standard preset security policy and block automatic external forwarding.
5. Day 3: Tighten SharePoint and OneDrive sharing and restrict app consent.
6. Day 3: Confirm audit logging and review your Secure Score.
7. Monthly: Review Secure Score, admin roles and guest accounts.

For a longer-term model, these steps are the foundation of zero trust security: verify every sign-in, give the least access needed and assume a breach can happen. Strong identity and email settings also cut the risk of ransomware, which our ransomware protection guide covers in depth. If you don’t have in-house IT, a good managed IT provider should be able to show you each of these settings in your tenant.

The bottom line

Microsoft 365 ships with strong protections, but several of the most important ones aren’t on until you turn them on, and small-business plans are the most likely to be missing them. Start with MFA, admin accounts and legacy authentication, then move to email, sharing and logging. Most of this costs nothing beyond the licenses you already pay for.

Sources

• Microsoft Learn: Configure security defaults for Microsoft Entra ID — what security defaults enforce, where to enable them, emergency access accounts
• Microsoft Learn: Mandatory multifactor authentication for admin portals — MFA enforcement for the Microsoft 365 admin center from February 2025
• Microsoft Learn: Preset security policies — Standard, Strict and Built-in protection, portal location
• Microsoft Learn: Control external email forwarding — outbound policy forwarding settings
• Microsoft Learn: Turn auditing on or off — audit defaults for small-business plans, 180-day retention
• Microsoft Learn: Microsoft Entra roles best practices — fewer than 5 Global Administrators