SOC 2 Type II audited 24/7 help desk Microsoft Solutions Partner Business IT support since 2010 Nationwide service, offices in NJ, PA, DE and NY

Securing the Tools Your Business Runs On

Microsoft 365 holds a business’s email, files, calendars and Teams conversations, and the same account often signs employees in to other applications. That makes it one of the first places attackers try to get in, usually through phishing emails and stolen passwords.

Microsoft provides strong security tools, but many of them must be turned on and configured for each business. Use this checklist to review your setup. For security beyond Microsoft 365, see our small business cybersecurity checklist. Some features depend on your Microsoft 365 plan; Microsoft 365 Business Premium, for example, includes Conditional Access, Intune device management and Microsoft Defender for Office 365 Plan 1.

Checklist Areas

  • Sign-in and identity
  • Administrator accounts
  • Email protection
  • Sharing and data
  • Devices
  • Backup, monitoring and training

Sign-In and Identity

  • Require multi-factor authentication (MFA) for every user, including executives and any shared account people sign in to.
  • Make sure older sign-in methods that cannot use MFA (legacy authentication) are blocked.
  • Use security defaults or, where your plan includes them, Conditional Access policies to control how and from where people sign in.
  • Disable accounts promptly when employees leave, and review guest accounts regularly. See our employee offboarding checklist.

Administrator Accounts

  • Give administrator rights only to the people who need them, using the most limited admin role that does the job.
  • Use separate administrator accounts for admin work, not the accounts used for everyday email.
  • Protect every administrator account with MFA, and keep emergency access accounts documented and secured.
  • Make sure your business, not an outside party, owns the top-level administrator access to your Microsoft 365 tenant.

Email Protection

  • Review the anti-phishing, anti-spam and anti-malware policies for your organization instead of relying only on the defaults.
  • Use Safe Links and Safe Attachments where your plan includes Microsoft Defender for Office 365.
  • Publish SPF, DKIM and DMARC records for your domain so other mail systems can verify email from your business.
  • Block automatic forwarding of email to outside addresses; attackers who take over a mailbox often set up forwarding rules.

Sharing and Data

  • Review external sharing settings for SharePoint, OneDrive and Teams, and limit links that anyone can open.
  • Set expiration dates for guest access and shared links where possible.
  • Use sensitivity labels or data loss prevention for sensitive information where your plan includes them.
  • Confirm that audit logging is turned on, so activity can be investigated if something goes wrong.

Devices

  • Manage company laptops and phones with Microsoft Intune or another device management tool.
  • Require device encryption, such as BitLocker on Windows, and a screen lock on every device.
  • Keep Windows, Microsoft 365 apps and browsers updated on a schedule.
  • Protect devices with endpoint protection that is monitored, not just installed.

Backup, Monitoring and Training

  • Back up Microsoft 365 email, OneDrive, SharePoint and Teams data. See our Microsoft 365 backup guide. Recycle bins and retention settings are not the same as an independent backup.
  • Review Microsoft Secure Score and sign-in alerts regularly.
  • Teach employees to spot phishing and to report suspicious emails quickly.
  • Write down who to call and what to do if an account is compromised.

How TechStarters Helps

TechStarters manages and secures Microsoft 365 as part of our managed IT services: multi-factor authentication, conditional access, identity protection, device management and ongoing administration. Our cybersecurity services add endpoint protection and monitoring, and our 24/7 help desk supports employees with Outlook, Teams, OneDrive and SharePoint.

Every engagement starts with a free IT assessment that includes a review of your Microsoft 365 setup, followed by a written proposal. If you work under HIPAA, SOC 2 or CMMC requirements, see our compliance-aligned IT services.

Microsoft 365 Security FAQs

Is Microsoft 365 secure by default?

Microsoft 365 includes strong security features, and newer tenants start with some protections turned on. Many settings still need to be reviewed and configured for each business, especially sign-in policies, sharing, devices and administrator access.

Does Microsoft back up our Microsoft 365 data?

Microsoft keeps the service available and offers recycle bins and retention settings, but these are not the same as an independent backup. A separate Microsoft 365 backup lets you restore email and files after deletion, ransomware or a compromised account. See backup and disaster recovery.

Which Microsoft 365 plan do we need for these settings?

Basic protections such as multi-factor authentication are available in every business plan. Conditional Access, Intune device management and Defender for Office 365 Plan 1 are included in Microsoft 365 Business Premium. We can review your licensing during the IT assessment.

How often should we review Microsoft 365 security?

Review it at least once a quarter, and whenever employees join or leave, you add an application or your cyber insurance questionnaire asks new questions. Managed IT services add ongoing monitoring between reviews.

Can you secure our Microsoft 365 if we already have IT staff?

Yes. With co-managed IT, your IT staff and our team share the work, and responsibilities are agreed in writing.

Explore Our Managed IT Services

Request a Managed IT Services Quote

Tell us about your business, your locations and your devices, and we will send a written proposal with per-device monthly pricing. Prefer to talk? Call (877) 932-0040.

Request a Quote