A Microsoft 365 Security Baseline for a Small Business

Microsoft 365 ships with most of its security switched off. The tenant works on day one, and the settings that would stop a phished password from becoming a mailbox takeover are waiting in the admin portals for someone to turn them on. With Business Premium, everything in this baseline is already licensed.

This is the set we apply to every tenant, in the order that gets the most protection soonest. Each item is a setting, not a product to buy.

Identity: Conditional Access first

Conditional Access is the control plane for who gets in, from where, with what. Security Defaults is the simpler on/off version and is fine for a tenant with no admin time at all, but Conditional Access is included in Business Premium and lets you be specific.

Create a break-glass account first: a cloud-only Global Administrator with a very long password stored offline, excluded from every policy, with an alert on any sign-in. Then build the policies, each in report-only mode for a few days before enabling.

Require MFA for all users on all cloud apps.
Require phishing-resistant MFA (authentication strength) for all directory roles.
Block legacy authentication. Then confirm nothing broke: Entra admin center > Monitoring > Sign-in logs, filter Client app to legacy protocols.
Block sign-ins from countries you do not operate in, using a Named Location.
Require a compliant device for Office 365 apps if devices are enrolled in Intune; otherwise require app protection policies on mobile.
Disable SMS and voice as MFA methods; enable Authenticator with number matching, and FIDO2 for admins.

Tenant settings that close common doors

A handful of tenant-wide toggles remove the paths attackers use once they have one mailbox.

User consent to applications: off. Entra admin center > Enterprise applications > Consent and permissions > Do not allow user consent. Turn on the admin consent request workflow so users can ask.
External forwarding: off at the remote domain and in the outbound spam policy. Set-RemoteDomain Default -AutoForwardEnabled $false
Guest access: restrict who can invite guests to admins or a named group, and review the guest list quarterly.
Global Administrators: two to four named accounts plus the break-glass. Everyone else gets a scoped role such as Exchange Administrator or Helpdesk Administrator.
Unified Audit Log: confirm it is on. Purview portal > Audit. In older tenants it had to be enabled by hand.

Connect-ExchangeOnline
Set-RemoteDomain Default -AutoForwardEnabled $false
Set-HostedOutboundSpamFilterPolicy Default -AutoForwardingMode Off
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

Defender for Office 365 and Defender for Business

Business Premium includes Defender for Office 365 Plan 1 for email and Defender for Business for endpoints. Both need policies turned on; the defaults are the equivalent of an antivirus with real-time protection off.

For email, the fastest route is the preset security policies. Defender portal > Email and collaboration > Policies and rules > Threat policies > Preset security policies. Apply Standard protection to all users and Strict to admins and finance. This configures anti-phishing with impersonation protection, Safe Links, Safe Attachments and the anti-spam actions in one step.

Apply the Standard preset to everyone and Strict to high-risk users.
Add the executives and finance team to the impersonation protection user list, and your key vendors' domains to the domain list.
Turn on Safe Attachments for SharePoint, OneDrive and Teams. It is a separate toggle under Safe Attachments > Global settings.
Enable the Report Message add-in for all users and route reports to a monitored mailbox.
Onboard every device to Defender for Business through Intune. Turn on tamper protection, cloud block level High, and ASR rules in audit mode.
Set alert notifications: Defender portal > Settings > Endpoints > Email notifications, and Purview alert policies for forwarding rules and unusual mail activity, to a mailbox someone reads daily.

Logs, backup and the monthly check

The audit log is what makes an incident investigable. Business Premium retains it for 180 days; longer retention needs an add-on or export to a SIEM. Sign-in logs in Entra ID retain 30 days on P1, which is short. Export both to storage you control if you can.

Microsoft 365 is not backed up by Microsoft in the sense of restoring a deleted tenant or a mailbox purged by an attacker. Retention policies help; a third-party backup product that writes to storage outside the tenant is the real answer.

Then keep it that way with a monthly look at the things that drift.

Secure Score in the Defender portal: read the recommended actions, do the ones that are settings.
Users without MFA registered, from the authentication methods report.
Global Administrator membership and any new Enterprise applications with mail or file permissions.
Inbox rules that forward or delete, tenant-wide, with Get-InboxRule.

Frequently asked questions

We are on Business Standard, not Premium. What can we do?

Security Defaults for MFA, the Exchange forwarding and consent settings, and the audit log are all available. Conditional Access, Defender for Office 365 and Defender for Business need Premium or add-ons. For most small businesses the price difference is the cheapest security upgrade available.

Will blocking legacy authentication break our scanner or an old app?

Sometimes, which is why you run it in report-only mode first and check the sign-in logs for legacy protocol use. Scanners can relay through a connector with a modern method; old apps that only speak basic auth need replacing since Microsoft has retired basic auth for most protocols anyway.

How long does the baseline take to apply?

A day for the settings and a week or two of report-only observation before the Conditional Access policies are enforced. RackLedge applies this baseline as a fixed-scope project and hands over the monthly checklist at the end.

Takeaway

Turn on Conditional Access with a break-glass account, close the forwarding and consent doors, apply the Defender presets to email and onboard every device, and make sure the audit log is on and someone reads the alerts. Everything here is included in Business Premium. The work is turning it on and checking it monthly.