Microsoft 365 Security Checklist for Small Offices
One page, five areas, 20 items. Each item links to the AdminPlainly guide that walks through it, and to Microsoft's own documentation where there is one. Print it, tick it off, and keep it with your admin notes.
Or use your browser's Print command. The site header and footer are left off the printout.
Written for a 5–50 person office on Microsoft 365, mostly Business Premium. Items marked (Business Premium) need Microsoft Entra ID P1 or Intune, which Business Premium includes. Checked against Microsoft Learn on 2026-10-23.
1. Sign-in and admin accounts
- Two emergency access ("break-glass") accounts exist, are cloud-only, and aren't tied to one person. Guide · Microsoft Learn
- Fewer than five people have the Global Administrator role. Microsoft Learn
- Everyone signs in with MFA, through security defaults or Conditional Access. Guide · Microsoft Learn
- Legacy authentication is blocked (Business Premium). Guide · Microsoft Learn
- Admins use phishing-resistant MFA, such as passkeys (Business Premium). Guide · Microsoft Learn
2. Email
- An SPF record lists Microsoft 365 and every other service that sends as your domain. Guide · Microsoft Learn
- DKIM signing is turned on for your custom domain. Guide · Microsoft Learn
- A DMARC record is published, starting at
p=noneand tightened once reports look clean. Guide · Microsoft Learn - Your domain passes the free SPF, DKIM, and DMARC checker.
3. Company PCs and phones
- Windows PCs enroll in Intune automatically (Business Premium). Guide · Microsoft Learn
- A compliance policy is assigned, and Conditional Access requires a compliant PC (Business Premium). Guide · Microsoft Learn
- BitLocker is on, and you know where to find the recovery keys. Guide · Microsoft Learn
- Windows LAPS manages the local administrator password. Guide · Microsoft Learn
- Windows updates are managed with Windows Autopatch or update rings. Guide · Microsoft Learn
- Personal phones that open work email have an app protection policy (Business Premium). Guide
4. Data and backup
- You know how long Microsoft 365 keeps deleted email, files and users. Guide · Microsoft Learn
- You've decided whether you need a backup, and if you have one, you've tested a restore. Guide · Backup options compared
5. People and passwords
- Shared passwords live in a business password manager, not a spreadsheet, ideally one that signs in with Entra ID. Guide · Password managers compared
- You have a written offboarding checklist and use it every time someone leaves. Guide
- Someone reviews Microsoft Secure Score on a schedule. (Monthly is my suggestion, not Microsoft's.) Microsoft Learn
From adminplainly.com/checklist/. Free to print and share. Microsoft changes menus and licensing often, so check the linked guide before you change a setting.