Microsoft 365 Security Checklist for Small Businesses

Any Microsoft 365 security checklist written before this year is now wrong in one important respect: multi-factor authentication is no longer a decision you get to make. Since February 9, 2026, Microsoft's mandatory MFA rollout has enforced MFA for all users signing in to the Microsoft 365 admin center, and the extension that let tenants with technical barriers postpone that enforcement until July 1, 2026 has expired. If your security plan was "we turned on MFA," Microsoft has just reclassified that from an achievement to a prerequisite.

RANGO Technologies supports small and mid-size businesses across Miami-Dade and Broward County from Miami Lakes, and the tenants we inherit are remarkably consistent: MFA is on, and almost nothing else is. What follows is the list of controls that are still off, permissive, or entirely absent in a default Microsoft 365 tenant, ordered by how much risk each one actually removes. Nine items, each with what the default is, what to change it to, and an honest note on what it does not cover.

Table of Contents

• What the February 2026 MFA Mandate Actually Covers
• Identity: Where Most of the Risk Still Lives
• Email: Stopping the Attack That Costs the Most Money
• Data: Sharing, Consent, and What Leaves the Tenant
• Visibility and Recovery: The Two Things Nobody Checks
• The Checklist in Priority Order
• Where to Start This Week

What the February 2026 MFA Mandate Actually Covers

The dates and the exact scope

Microsoft began requiring MFA for accounts accessing the Microsoft 365 admin center on February 3, 2025, phased tenant by tenant. From February 9, 2026, enforcement covers all users signing in to the admin center, across admin.microsoft.com, admin.cloud.microsoft and portal.office.com/adminportal/home. Tenants that hit technical barriers were allowed to postpone that second phase until July 1, 2026, and that window has now closed.

Read the scope again, because most of the coverage overstated it. The mandate governs sign-in to the admin center. It does not, by itself, require MFA for a salesperson opening Outlook on a phone, for a shared mailbox accessed from a laptop, or for a service account authenticating against a line-of-business application. Microsoft has raised the floor under the most privileged surface in your tenant. Everything above that floor is still your configuration.

Why the floor is not the program

The reason this distinction matters is that the expensive attacks do not target the admin center. They target the person who pays invoices. The FBI IC3 2025 Internet Crime Report recorded $3,046,598,558 in reported business email compromise losses in 2025, the second-largest loss category of the year. Those losses came out of ordinary mailboxes, not admin portals.

So treat February 9, 2026 as the moment the baseline moved, then work the rest of the list. If you want the same exercise applied to your endpoints rather than your tenant, our checklist for businesses still running Windows 10 after end of support covers that side.

Identity: Where Most of the Risk Still Lives

Extend MFA past the admin center, and make it phishing-resistant

Control one is coverage. Every user, every workload, on every sign-in from an unmanaged location. In Microsoft 365 Business Premium that means Conditional Access, which comes with the Microsoft Entra ID P1 licensing included in that plan; on the lower Business plans you get security defaults, which are better than nothing and considerably less precise.

Control two is method quality. CISA's #StopRansomware Guide recommends implementing phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems. Phishing-resistant means passkeys or hardware security keys, which bind the login to the real site. SMS codes and approval prompts can both be relayed through a proxy page in real time, and prompt fatigue is a documented attack, not a theory. Start with the accounts that can move money or change tenant configuration, then widen.

Separate admin accounts, and a break-glass pair

Control three: the person who administers your tenant should not be reading email with those credentials. Give administrators a second, licensed-appropriately account used only for administration, with no mailbox and no browsing. One phished session on a daily-driver account then costs you a mailbox rather than the tenant.

Control four: create two break-glass accounts excluded from Conditional Access, with long random passwords stored offline and sign-in alerting attached to them. Every organization that has locked itself out of its own tenant with a policy change learned this the hard way. This is a small piece of housekeeping that pays for itself exactly once.

Block legacy authentication

Control five, and the cheapest win on this page. Legacy authentication protocols predate modern MFA and cannot present a second factor, so a password sprayed against them succeeds outright regardless of your MFA policy. Block them tenant-wide, then check your sign-in logs for what breaks. In most small tenants the answer is a scanner or copier that emails documents, and the fix is switching it to authenticated SMTP submission or a dedicated relay rather than leaving the protocol open for everyone.

Email: Stopping the Attack That Costs the Most Money

Mailbox forwarding and hidden inbox rules

Control six. The signature move of a compromised mailbox is a rule that forwards messages containing words like invoice, wire or bank to an external address, or that moves the finance thread into a folder the owner never opens. The attacker then reads correspondence for weeks, learns the language, and interjects at the moment a payment is due.

Turn off automatic external forwarding at the tenant level, allow it by exception only, and set an alert on the creation of new inbox rules and forwarding rules. Then check existing mailboxes for rules that are already there. Finding one is not rare, and the discovery usually predates the incident that would have made it obvious. The human-side counterpart to this control is covered in our guide to spotting phishing emails before they cost your business money.

SPF, DKIM and a DMARC policy that actually does something

Control seven. Most tenants publish SPF, many have DKIM signing enabled, and very few have moved DMARC past a monitoring policy. A DMARC record set to none tells receiving servers to do nothing about mail that fails authentication, which means anyone can send as your domain and your customers have no protection.

The path is straightforward and should not be rushed: publish DMARC at none with a reporting address, read the reports for a few weeks until every legitimate sender is identified and aligned, then move to quarantine, then to reject. The FTC's small-business cybersecurity guidance treats impersonation of your business as your problem to manage, which is exactly what a reject policy addresses. Skipping the monitoring phase is how a business breaks its own invoicing.

Impersonation protection for the names that matter

Control eight. Configure anti-phishing protection to specifically watch for impersonation of your own domain, your lookalike domains, and the handful of individuals attackers would pretend to be: the owner, the controller, whoever signs off on payments. Add your key vendors' domains as protected senders. Generic spam filtering does not know that a message from your bookkeeping firm's near-identical domain is worth flagging; a configured impersonation policy does.

Data: Sharing, Consent, and What Leaves the Tenant

SharePoint and OneDrive sharing defaults

Control nine. A default tenant is built for frictionless collaboration, which is the correct default for a product and the wrong default for a business with client data in it. Two settings do most of the work: set the default sharing link to people in your organization rather than anyone with the link, and put an expiration on any anonymous link you do permit.

Then look at guest access. Guests accumulate. A contractor added to a project site in 2023 is often still there, still able to open the folder, and long past any relationship with your business. A quarterly review of external users takes twenty minutes and is the single most reliable way to find data exposure nobody intended.

OAuth app consent, the gap that survives MFA

This one deserves its own paragraph because it defeats the control most people are relying on. A consent-phishing attack does not ask for a password. It presents a genuine Microsoft consent screen for an application requesting permission to read mail and files, and if the user clicks accept, the application holds a token that keeps working after a password reset. MFA was satisfied. The attacker never needed the credential.

Restrict user consent so that only administrators can approve applications requesting sensitive permissions, and enable the admin consent request workflow so people can still ask rather than being blocked with no path. Then audit the applications already consented to in your tenant. This is the item we most often find has never been looked at, and our Microsoft 365 consulting engagements usually start here.

Visibility and Recovery: The Two Things Nobody Checks

Audit logging and alert policies

Unified audit logging gives you the record of who signed in from where, which files were downloaded, and what changed in configuration. Confirm it is on, confirm the retention period matches what an investigation would need, and add alert policies for the events that matter: risky sign-ins, mass file download, new forwarding rules, elevation of a user to an admin role.

Logging is only half a control if nobody reads it. A tenant generating alerts into an unmonitored mailbox produces evidence after the fact and nothing before it, which is why our MDR and XDR service pairs the tooling with people who respond to what it produces. If you are not going to staff that, at minimum route the highest-severity alerts somewhere a human looks daily.

Backup, because Microsoft's responsibility ends before yours does

Microsoft keeps the service running and replicates your data across its own infrastructure. That is resilience against Microsoft's failures, not against yours. Retention policies expire, a departing employee's OneDrive gets deleted with their account, an administrator empties a site, ransomware syncs encrypted files up from a laptop. Recovering from any of those inside the native retention windows is a race against a clock you do not control.

An independent backup of Exchange Online, SharePoint, OneDrive and Teams data, held outside the tenant with its own retention, closes that gap. The same principle applies here as everywhere else in CISA's #StopRansomware Guide: maintain offline, encrypted backups and regularly test the availability and integrity of those backups in a disaster recovery scenario. A backup you have never restored from is an assumption.

The Checklist in Priority Order

Two notes on using this table. Immediate means this week, because each of those four either closes a bypass of MFA or removes an attacker's persistence mechanism. Medium does not mean optional; it means the item is unlikely to be the thing that gets exploited on Tuesday.

Where to Start This Week

If you do nothing else, do the four immediate rows. Extend MFA beyond the admin center with phishing-resistant methods for anyone who can move money or change configuration, block legacy authentication, split your admin identities and stand up break-glass accounts, and shut off external forwarding with alerting on new inbox rules. That is a half-day of work in most small tenants and it removes the specific paths that make a compromised Microsoft 365 account profitable.

Then be honest about what happens next. Configuration drifts, licensing changes, staff join and leave, and a tenant reviewed once in 2024 is not the tenant you have today. That ongoing review is the practical argument for managed IT services rather than a one-time hardening project, and it is where our cybersecurity work spends most of its time. No configuration removes the possibility of a breach; the goal is fewer paths in, and faster recognition when someone finds one.

If you would like to know which of the nine items above are open in your tenant right now, request a free IT assessment and we will tell you, in writing, including the ones you have already handled. Every engineer who would look at your systems is based in South Florida. Call (305) 901-8990, Monday through Friday, 8:00 AM to 5:00 PM ET.