The M365 baseline: eight moves that actually matter
Most small-organization M365 tenants run close to default settings, and defaults optimize for adoption, not protection. Microsoft wants your rollout to go smoothly; attackers know exactly what "smoothly" leaves open.
This is the ordered list worth working through on any tenant. Deliberately no click-by-click instructions — admin portals change layout twice a year, but what to configure and why stays stable. Each item names where to look; current docs will get you the rest.
1. MFA for everyone — phishing-resistant for admins
If you have no premium licensing, turn on Security Defaults (Entra ID) and you're 80% there. If you hold Entra ID P1 (included in Business Premium and E3), use Conditional Access instead — it lets you require MFA by condition and risk rather than as a blunt instrument. For the handful of admin accounts, step up to phishing-resistant methods (passkeys/FIDO2): admins are the accounts attackers spend real effort on, and push-notification MFA is increasingly fatigued and bypassed.
2. Block legacy authentication
Legacy protocols (IMAP, POP, SMTP basic auth) don't support MFA — they're the open window beside your newly locked door, and password-spray attacks target them specifically. Security Defaults blocks legacy auth automatically; with Conditional Access, build an explicit block policy. Check sign-in logs first for anything still using legacy auth (usually an old scanner or a line-of-business app) so you can fix it instead of breaking it.
3. Admin hygiene
Three rules: two to four Global Administrators, no more. Separate accounts for admin work — nobody administers the tenant from the account that reads email. And one documented break-glass account — strong credentials stored offline, excluded from Conditional Access, monitored for any use — so an MFA outage or a misconfigured policy can't lock you out of your own tenant. Use the least-privileged admin role that does the job; "make them Global Admin" is never the answer to a permissions question.
4. Email authentication: SPF, DKIM, DMARC
This protects your domain, not just your inbox — it's what stops attackers from convincingly impersonating you to your own customers and vendors. SPF is usually set; DKIM is a few clicks in Defender admin; DMARC starts at p=none to observe, then moves to quarantine and reject as you confirm legitimate senders. Most organizations stall at p=none forever — that's monitoring, not protection. Put the ratchet dates in your calendar.
5. Rein in external sharing defaults
SharePoint and OneDrive default to permissive sharing ("Anyone" links in many tenants). Set the default to specific people or existing guests, set link expiration, and decide deliberately which sites genuinely need anonymous links. This is the control that prevents the quiet failure mode of M365: a sensitive folder shared via a forwardable link two years ago that nobody remembers.
6. Confirm audit logging and know your retention
When something goes wrong, the audit log is the difference between an investigation and a guess. Confirm unified audit logging is on (it usually is now, but verify — a surprising number of tenants have gaps), and know your retention window — 180 days on standard licensing. If an incident response would need to look back further, plan an export or upgraded retention before you need it. You can't retroactively log anything.
7. Turn on the email protections you're paying for
If you hold Defender for Office 365 (included in Business Premium), apply the preset security policies — Standard for most organizations — instead of hand-tuning Safe Links, Safe Attachments, and anti-phishing one toggle at a time. Microsoft maintains the presets; hand-tuned policies rot. Reserve your customization energy for the user-impersonation protection list: add your executives and finance team, because that's who gets spoofed in payment-fraud attempts.
8. Bring devices into the picture
If you're licensed for Intune, enroll devices, define a compliance policy (encryption on, OS current, screen lock), and then use Conditional Access to require a compliant device for access to company data. This is the move that finally answers "what about everyone's laptops?" — and it makes the eventual departure of a laptop a non-event instead of an incident.
On Secure Score: use it as a free, prioritized to-do list — it's genuinely good for that. But don't chase the number. These eight items first; the score follows. A tenant can score impressively while missing DMARC enforcement and admin separation, and those are what an incident will actually hinge on.
Sequence, evidence, done
Work the list in order — items 1–3 close the door attackers use most, 4–6 limit blast radius, 7–8 raise the floor. The order is the point: fixing anything other than the current weakest link improves the audit score, not the outcome. Date-stamp a screenshot or settings export as you finish each one. That's eight artifacts of evidence for your gap assessment, generated as a byproduct of just doing the work. That's how a small team does compliance: once, while operating, instead of twice.