Microsoft 365 Security Checklist for UK SMEs

Microsoft 365 can be working perfectly while important security questions remain unanswered.

Can a former employee still access company information? Are administrators using their privileged accounts for everyday email? Who investigates a suspicious sign-in? When did someone last test that critical business data could actually be restored?

These are different questions from whether Outlook opens or Teams meetings work.

Microsoft operates the underlying cloud services, but organisations retain responsibilities for their information, identities, access controls and the configuration of the services they use. Moving to Microsoft 365 does not remove those responsibilities. Microsoft Learn

For a growing business, the objective should be straightforward:

Know what is protected, understand the gaps and be able to demonstrate that the controls are working.

This checklist provides a practical starting point for directors, operations teams and the people responsible for managing Microsoft 365.

It is not a certification assessment or a recommendation to switch every security setting on without understanding the impact. Use it to structure a review, agree priorities and establish clear ownership.

1. Understand your environment and the protection you have licensed

Start with an inventory of the environment you are trying to protect.

Record your Microsoft 365 subscriptions, active users, administrators, company domains, devices and external organisations with access. Identify who is responsible for configuration, monitoring, support and recovery.

Then check what your subscriptions actually include.

For example, Microsoft 365 Business Premium includes Microsoft Entra ID P1, Intune Plan 1, Defender for Business and Defender for Office 365 Plan 1, alongside information-protection capabilities. Those are distinct services with different purposes; they should not be treated as interchangeable or assumed to be fully deployed because a licence has been assigned. Microsoft Learn

Match each required control to the relevant licence, configuration and operational owner. Where a capability is unavailable, record how you will address the requirement rather than simply leaving it unchecked.

Evidence to request: A current user and licence inventory, a record of enabled security services and an agreed division of responsibilities between your business and its IT provider.

2. Verify that multifactor authentication is enforced

Having employees register an authentication method is not the same as proving that the right sign-in policies protect their accounts.

Microsoft recommends using Security Defaults or Conditional Access to manage multifactor authentication, rather than relying on legacy per-user MFA settings. Security Defaults provides a baseline without additional Entra licensing; Conditional Access requires Microsoft Entra ID P1 or above and provides more granular controls. Microsoft Learn

Review which users and applications are covered, what exclusions exist and whether legacy authentication is blocked.

Where supported, prioritise phishing-resistant authentication for administrators and other sensitive roles. Passkeys, including suitable FIDO2 security keys, provide phishing-resistant authentication rather than relying on a password followed by a conventional verification code. Microsoft Learn

Security Defaults and enabled Conditional Access policies are alternative approaches, not settings to run together. Plan any transition carefully so that disabling the baseline does not leave a gap in protection. Microsoft Learn

Evidence to request: Active policy coverage, authentication-method records, documented exceptions and sample sign-in results showing the expected controls were applied.

3. Separate administrative access from everyday work

An account used to manage Microsoft 365 should not also be the account used for routine email, browsing and document collaboration.

Use separate administrative identities and assign the least-privileged role needed for the task. Microsoft specifically recommends separating administration from standard productivity activity and limiting highly privileged roles. Microsoft Learn

Check who holds administrative access, why they need it and whether that justification remains current. Include external support providers, not only employees.

Also prepare for the possibility that normal administrative access becomes unavailable. Microsoft recommends two or more emergency access accounts, with strong authentication, securely stored credentials, monitoring and regular testing. They should be reserved for emergency use—not become convenient everyday administrator accounts. Microsoft Learn

Evidence to request: A privileged-role register, the latest access review and a tested emergency-access procedure.

4. Make joining, changing roles and leaving controlled processes

Access should reflect a person’s current responsibilities.

When someone joins, approve the access they need. When they move roles, review what should be removed as well as what should be added. When they leave, follow an agreed process that addresses both access and business continuity.

Microsoft’s offboarding guidance treats blocking access, preserving required information, handling devices and managing licences as separate steps. Removing a licence is not a substitute for completing the offboarding process. Microsoft Learn

Apply the same discipline to contractors and guests. Give external access an owner and review date, rather than assuming that an invitation remains appropriate indefinitely.

A useful test is to select a recent departure and trace the whole process: who authorised it, when access was blocked, what happened to the device and who took responsibility for the information.

Evidence to request: Completed onboarding and offboarding records, role-change approvals and a recent review of external access.

5. Check device security—not just device registration

Include every device permitted to access business information: Windows laptops, Macs, phones, tablets and approved personal devices.

Review supported operating systems, security updates, encryption, endpoint protection, screen-lock settings and local administrator access. Agree how personally owned devices will be handled rather than leaving them outside the discussion.

Microsoft Intune compliance policies can assess device configuration, and Conditional Access can use those results to restrict access. However, a device being enrolled in Intune does not itself demonstrate that meaningful compliance rules have been assigned and enforced. Microsoft Learn

Check how your environment treats devices with no compliance policy and devices that have stopped reporting.

A green status is useful only when you understand what was checked to produce it.

Evidence to request: A device inventory, patch and encryption reports, endpoint-protection coverage, compliance-policy assignments and recorded exceptions.

6. Review email protection and protect your sending domains

Assess which email-protection policies actually apply to your users.

Microsoft provides Standard and Strict preset security policies, with available protections depending on the services licensed. Review recipient coverage, exclusions and policy precedence rather than assuming that creating a policy means everyone receives it. Microsoft Learn

For organisations using Defender for Office 365, include Safe Links, Safe Attachments and impersonation protection in that review. Also check who handles quarantined messages and how suspicious emails reach the support or security team.

Separately, review SPF, DKIM and DMARC for your sending domains. These mechanisms work together to authenticate email and help receiving systems identify messages that misuse your domain. Include legitimate third-party senders, such as marketing and invoicing platforms, before tightening enforcement. Microsoft Learn

Treat automatic external forwarding as an explicit business decision with documented exceptions.

Evidence to request: Effective email-policy assignments, domain-authentication results, forwarding exceptions and a tested reporting route.

7. Review who can access and share company information

Start with information whose exposure would matter: payroll, employee records, customer documents, financial information and commercial proposals.

For the relevant SharePoint sites, Teams and OneDrive locations, check ownership, membership and sharing arrangements. Ask whether broad access was intentional and whether it remains necessary.

Microsoft supports different external-sharing levels, including authenticated guest access and unauthenticated Anyonelinks. Organisation-level and site-level settings interact, so reviewing only the tenant-wide setting does not establish the complete position. Microsoft Learn

Prefer named recipients for sensitive collaboration and restrict anonymous sharing where it is not appropriate. Test access with representative users rather than judging it solely from an administrator’s view.

Where suitable and licensed, assess sensitivity labels and data-loss-prevention controls alongside permissions. These capabilities should support an agreed approach to handling information, not replace one. Microsoft Learn

Evidence to request: Site owners, membership and sharing reports, documented protection rules and sample access tests.

8. Review connected applications, consent and AI access

User accounts are not the only route into business information.

Review the applications connected to Microsoft 365, the permissions they have received and who approved them. Include integrations, automation tools and AI services.

Microsoft Entra provides controls over application consent, including restricting user consent to selected low-impact permissions for applications from verified publishers. Review the actual policy in your organisation rather than assuming every consent request requires an administrator. Microsoft Learn

For each material integration, identify its business owner, purpose, permissions and continued need. An application that was useful for a short project should not retain broad access simply because nobody owns its removal.

For AI assistants and agents, assess what they can read separately from what they can change. Our guide, AI Governance: Adopt AI Without Losing Control, explains how to set those boundaries and maintain oversight.

Evidence to request: An application register, permission and consent records, named owners and a recent review of unused integrations.

9. Confirm that audit logs are available and alerts have an owner

Do not assume that useful audit history will be available when you need it.

Microsoft’s current guidance specifically warns that auditing is not enabled by default for Microsoft 365 Business Basic, Business Standard and Business Premium licences. Check your tenant’s actual auditing status and confirm that relevant events can be retrieved. Microsoft Learn

Also distinguish between the different records available. Microsoft Entra sign-in logs, Microsoft 365 audit records and security alerts serve different purposes. Check their coverage, retention and the licences needed for your requirements.

Then establish who acts on the information.

Which alerts require investigation? Who receives them? What happens outside agreed support hours? How are incidents escalated to the business?

A notification delivered to an unattended mailbox is not an effective response process.

Evidence to request: A successful audit search, documented retention periods, alert recipients and recent investigation records.

10. Test recovery against the needs of the business

Start with the outcome you need:

What information must we recover, how far back must we be able to go and how long can the business operate without it?

Check your existing recovery features and backup arrangements against those requirements.

Microsoft provides built-in resilience and recovery capabilities, and offers Microsoft 365 Backup for selected Exchange mailboxes, SharePoint sites and OneDrive accounts. That does not mean every workload, configuration or recovery scenario is automatically covered by your current arrangement. Microsoft Learn

Evaluate the chosen Microsoft or third-party solution by its actual scope, recovery options, retention and access controls.

Then restore representative data and record the result. The NCSC advises organisations to check both that backups contain important information and that they know how to restore them. National Cyber Security Centre

Evidence to request: A protection inventory, agreed recovery targets and a recent restore test showing what was recovered and how long it took.

11. Practise reporting and responding to an incident

Give staff a clear route for reporting suspicious messages, unexpected authentication prompts, lost devices and unusual account activity.

Make the instruction practical: who to contact, how to contact them and what to do when normal email cannot be trusted.

The NCSC recommends checking doubtful messages through independently obtained contact details and having a plan that defines who does what when an attack occurs. Build those habits into onboarding and refresher training. National Cyber Security Centre

The technical response also needs to go beyond resetting a password. Microsoft’s compromised-account guidance includes containing access, revoking sessions and reviewing authentication methods, application permissions, administrative roles and mailbox forwarding. Microsoft Learn

Run a short exercise involving both the business and its IT provider. For example: a finance employee reports an email they did not send, and a customer has received altered payment instructions.

Evidence to request: Staff guidance, incident contacts, a response procedure and the actions recorded after an exercise.

12. Turn the checklist into an ongoing review

Do not treat the review as complete simply because every row has a tick.

For each control, record its owner, current status, supporting evidence, exceptions and next review date. Assign actions to the gaps and track whether those actions are completed.

Microsoft Secure Score can help identify and prioritise improvements, but Microsoft explicitly states that it is not an absolute measure of breach likelihood or a guarantee of protection. Use it as one input—not as a substitute for assessing your environment. Microsoft Learn

A practical review should ask whether controls still apply to the right users, devices and services, whether exceptions remain justified and whether recent changes have introduced new exposure.

The useful question is not “What is our score?” but “Which material risks remain, and what are we doing about them?”

Evidence to request: An action register, recorded risk decisions and evidence that agreed improvements have been implemented and checked.

Where should an SME start?

Use the checklist to establish priorities, not to create an unmanageable project.

First, close immediate exposure. Review unprotected sign-ins, unnecessary privileged access, former-user access, unprotected devices and sensitive information shared too widely.

Then, strengthen detection and recovery. Verify audit availability, alert ownership, incident contacts and the ability to restore critical information.

Finally, make the controls repeatable. Improve onboarding, offboarding, application approval, access reviews and change management so that the same gaps do not keep returning.

Those are suggested priorities, not a substitute for assessing the consequences and dependencies in your own environment. Test changes, communicate with affected users and keep a recovery route available.

The aim is not to make Microsoft 365 difficult to use.

It is to make secure working the normal way the organisation operates.

How Symposium IT helps

Symposium IT’s managed workplace and IT support services bring Microsoft 365 administration, identity and access management, device management and ongoing support together.

Through Symposium One, organisations can agree the coverage appropriate to their environment—from everyday workplace support to enhanced governance, device compliance and ongoing optimisation. Additional device-management and security requirements are scoped explicitly.

A useful starting point is a clear account of your current position: what is configured, what is operating, where the gaps are and who will address them.

Speak to Symposium IT about reviewing your Microsoft 365 environment.

Microsoft 365 security should be demonstrated, not assumed.

Run. Assure. Transform.