Microsoft 365 Security Baseline for SMEs

Published: 12 June 2026 · Updated: 6 October 2026

Most businesses think of Microsoft 365 as email and Office apps. Attackers think of it as identity, data, payments, conversations and permission to move around quietly. That is why the baseline matters.

A secure Microsoft 365 tenant is not built by turning on one setting and declaring victory. MFA helps, but MFA on its own is not a strategy. The work is in the policy, the exceptions, the monitoring and the boring little controls that stop a normal account compromise becoming a company-wide problem.

What your licence lets you enforce

Before the settings, the licence, because it decides what’s possible. On Business Basic and Business Standard you get security defaults: free, sensible, but all-or-nothing. Business Premium adds Entra ID P1 for Conditional Access, Intune for device management and Defender for Business for endpoints. Most of this article assumes Premium, because most of it can’t be done properly without it.

Worth knowing: when Microsoft raised most Microsoft 365 prices in July 2026, Business Premium’s list price didn’t move. If you’re on Basic or Standard because nobody ever reviewed it, the gap is smaller than it used to be. (More in our guide to the July 2026 changes.)

Protect identity first

Your Microsoft 365 account is now the front door to the business. Every user should have MFA, but the better question is whether sign-in is being judged properly. Conditional Access should look at risk, location, device state, application and role before granting access.

Phishing-resistant MFA, in practice

Push notifications alone can be worn down by repeated prompts until someone taps “approve” to make them stop. A good baseline removes the easy wins for attackers rather than hoping users will spot every trick:

• Number matching on Authenticator prompts, so a user has to type the number on screen rather than just approve.
• Phishing-resistant methods for admins, enforced through Conditional Access authentication strengths.
• Passkeys and FIDO2 security keys where you can. The NCSC rates FIDO2 among the most secure options (NCSC), and Cyber Essentials now explicitly counts FIDO2 authenticators as MFA.

Lock down app consent

One of the most overlooked Microsoft 365 risks is third-party app consent. A user can be tricked into granting an application access to mailbox, files or profile data. No password theft required. No dramatic malware moment. Just a polite-looking consent screen and a bad decision.

SMEs should normally restrict user consent to unverified apps, use an admin consent workflow and review existing enterprise applications. If nobody can explain why an app has access to mail or files, it needs investigating.

Stop email abuse

External forwarding should be blocked unless there is a clear business reason, and set to off explicitly rather than left on Microsoft’s automatic setting, which behaves differently in older tenants. Mailbox rules should be monitored. SPF, DKIM and DMARC should be configured properly (NCSC email security guidance). These controls are not exotic; they are part of running email responsibly.

Attackers love quiet persistence. A mailbox rule that forwards invoices or hides replies can cause real damage without ever setting off the kind of alarm people imagine when they hear the word cyber. Our free domain impersonation check shows the other side of the same fraud: lookalike domains registered to pretend to be you.

Protect admin access

Admin accounts should be separate from daily user accounts, protected with stronger authentication and limited to the permissions needed. Shared admin logins and unknown legacy accounts are usually signs that nobody has owned the tenant properly for a while. That is fixable, but it needs deliberate cleanup rather than another licence purchase.

Break-glass access should exist, and be done properly. Microsoft’s emergency access guidance boils down to: at least two cloud-only accounts on the .onmicrosoft.com domain, protected with phishing-resistant authentication, excluded from the Conditional Access policies that could lock everyone out, with an alert on every sign-in, and tested regularly so you know they work before you need them.

Know which devices are trusted

Microsoft 365 security is weaker if unmanaged personal devices can access company data without restriction. A sensible baseline uses Intune or equivalent controls to separate trusted devices from unknown devices, apply compliance rules and protect business data if a laptop is lost or an employee leaves.

Monitor the tenant, and keep the logs long enough

The baseline is not finished when the settings are changed. Sign-in logs, risky users, admin role changes, mailbox forwarding and suspicious app grants need review. If nobody is looking, you do not have monitoring; you have logs.

And check how long those logs last. Entra sign-in and audit logs are kept for 7 days on the free tier and 30 days with P1 (Microsoft Learn). Compromises are often discovered weeks after they start, by which point the evidence of how they began may already be gone. If you’d need to reconstruct an incident, export the logs somewhere that keeps them longer.

Book a free security and IT health check or read more about our Microsoft 365 baseline management.