The Essential Microsoft 365 Security Hardening Checklist for Small Businesses

Microsoft 365 powers daily communications, file collaboration, and authentication for millions of businesses. However, a newly provisioned Microsoft 365 tenant is configured out of the box for maximum convenience, not maximum security.

Default settings often leave legacy authentication protocols open, audit logging underconfigured, and mailbox forwarding rules unrestricted.

Review this operational checklist to harden your Microsoft 365 environment against credential stuffing and Business Email Compromise (BEC).

1. Enforce Phishing-Resistant MFA & Disable Legacy Auth

Standard SMS-based verification is vulnerable to SIM-swapping and adversary-in-the-middle (AiTM) proxy phishing toolkits.

Transition to Authenticator Apps or FIDO2: Require the Microsoft Authenticator app with number matching or hardware security keys.
Block Legacy Authentication: Disable basic authentication protocols (POP3, IMAP, SMTP AUTH, MAPI) via Conditional Access policies. Legacy protocols bypass multi-factor authentication checks entirely.

2. Implement Strategic Conditional Access Policies

If your licensing includes Microsoft Entra ID P1 / Business Premium, deploy targeted Conditional Access policies:

Geographic Restrictions: Block login attempts originating outside countries where your employees physically reside.
Device Compliance Requirements: Require devices to be domain-joined or marked compliant in Microsoft Intune before granting access to company SharePoint or OneDrive repositories.
Risk-Based Sign-Ins: Automatically require password resets or step-up authentication when Microsoft's identity protection flags impossible travel or leaked credentials.

3. Prevent External Auto-Forwarding Rules

A primary indicator of Business Email Compromise (BEC) occurs when an attacker compromises an inbox and immediately creates an Outlook rule forwarding all incoming financial communications to an external mailbox.

Navigate to the Exchange Admin Center $\rightarrow$ Mail Flow $\rightarrow$ Remote Domains.
Set Automatic forwarding to Disabled across default remote domains.
Create an alert policy that immediately notifies IT administrators whenever a mailbox forwarding rule is created.

[ Compromised Account ] ──( Attempts External Forward )──► [ Exchange Policy: BLOCKED ]
                                                                      │
                                                                      ▼
                                                          [ Security Alert to MSP ]

4. Harden Anti-Phishing & Safe Links Policies

In the Microsoft Defender portal, elevate default protection thresholds:

Enable Safe Links: Scans URLs in real time at time-of-click across Outlook, Teams, and Office documents.
Enable Safe Attachments: Detonates email attachments in a secure sandbox before delivering the message to the user's inbox.
Turn On First-Contact Safety Tips: Injects a warning banner at the top of an email when a user receives a message from an address they haven't communicated with previously.

5. Enable Unified Audit Logging (UAL) & Mailbox Auditing

Ensure your organization maintains a clear forensic trail for incident response:

Verify that Unified Audit Logging is turned ON in the Microsoft Purview compliance portal.
Ensure audit retention policies retain administrator and user sign-in logs for at least 180 to 365 days to meet cyber insurance and regulatory compliance requirements.

Audit Your Microsoft 365 Tenant

Securing cloud identity requires continuous oversight, policy reviews, and automated licensing management.

Secure your cloud collaboration suite: Schedule a Microsoft 365 Security Review with KorvuTech.