The short version
- 01Most Microsoft 365 compromises start with a stolen password — multi-factor authentication is the first thing to switch on.
- 02Microsoft keeps the service running; who can sign in, what they can reach and whether data can be recovered is up to you.
- 03Business Premium adds the tools small teams usually need: Conditional Access, Intune and Defender for Business.
Microsoft 365 runs email, files and meetings for a huge number of Australian small businesses. It’s also where a lot of attacks start — usually with a convincing email and a stolen password. Most of the protection you need is already in the product; it just isn’t all switched on.
First, whose job is whose#
Microsoft is responsible for keeping the service itself secure and available. Your business is responsible for who can sign in, what they can reach, how devices are managed and whether data can be recovered. That second list is where this checklist lives.
The checklist#
1. Turn on multi-factor authentication for everyone
Every account, including the owner’s. If nothing else is configured yet, Microsoft Entra security defaults are a no-cost way to require MFA across the whole tenant.
2. Separate admin accounts from everyday accounts
Admins should do their daily work — email, browsing — on a standard account, and use a separate account only for administration. Keep the number of global administrators small.
3. Block legacy sign-in methods
Older authentication protocols can’t do MFA, which makes them a favourite way around it. Security defaults and Conditional Access can both block them.
4. Use Conditional Access if you have Business Premium
Conditional Access lets you set rules such as ‘only allow sign-ins from managed devices’ or ‘require MFA outside the office’. It comes with Microsoft Entra ID P1, which is included in Business Premium.
5. Manage devices with Intune
Intune lets you enforce updates, encryption and screen locks, and remove company data from a lost laptop or phone. It’s the difference between hoping devices are patched and knowing they are.
6. Protect email beyond the basics
Microsoft Defender for Office 365 Plan 1, included in Business Premium, adds protection against malicious links and attachments. Pair it with SPF, DKIM and DMARC records on your domain so others can’t easily send email pretending to be you.
7. Put endpoint protection on every device
Microsoft Defender for Business is designed for organisations of up to 300 users and is included in Business Premium. It protects devices against ransomware, malware and phishing, with one place to see alerts.
8. Review external sharing
Decide whether files in SharePoint and OneDrive can be shared with anyone who has the link, or only with specific people. The default is often more open than a business needs.
9. Back up Microsoft 365 data
Retention settings and the recycle bin aren’t the same as a backup you control. A dedicated backup protects against accidental deletion, a departing staff member, or ransomware that syncs through OneDrive.
10. Watch the sign-in and audit logs
Unusual sign-ins, new mailbox forwarding rules and mass file downloads are early signs of a compromised account. Someone needs to be looking — or the alerts need to go somewhere that gets read.
Where to start this week#
If you do nothing else: MFA for everyone, separate admin accounts, and a check of who can share what. Those three close the most common doors. If you’d rather hand it over, we set up and look after Microsoft 365 security as part of managed IT.
Common questions
Is multi-factor authentication included in Microsoft 365?
Yes. Security defaults in Microsoft Entra ID can require MFA for all users at no extra cost, and Business Premium adds Conditional Access for finer control.
What does Microsoft 365 Business Premium add over Business Standard?
Security and device management: Microsoft Entra ID P1 for Conditional Access, Microsoft Intune, Microsoft Defender for Business and Microsoft Defender for Office 365 Plan 1, for organisations of up to 300 users.
Does Microsoft back up my Microsoft 365 data?
Microsoft keeps the service resilient and provides retention features, but that isn’t the same as a backup you control. Most businesses benefit from a dedicated backup of mailboxes, OneDrive and SharePoint.
