Microsoft 365 Security Best Practices for 2026
Eight settings that close the gaps we find most often in small-business Microsoft 365 tenants, each with where to find it and which licence it needs. Start with the ten-minute check at the top to see where you stand.
Reviewed by the ITRS security team · Last updated
Check yours in ten minutes
You need a Global Administrator or Global Reader account. Write down each answer before changing anything.
Secure Score
Open the Microsoft Defender portal and look at Microsoft Secure Score. Note the percentage and the top five recommended actions.
Admin count
Microsoft 365 admin centre > Roles > Global Administrator. Count the members. Microsoft recommends fewer than five.
MFA
Entra admin centre: is security defaults on, or are Conditional Access policies requiring MFA for all users? If neither, stop here and fix it first.
Legacy authentication
Entra sign-in logs, filtered by client app for legacy protocols. Any recent successful sign-ins mean MFA can be bypassed.
DMARC
Check your domain with our email spoof check. p=none means you are monitoring, not protected.
The local picture
On 5 August 2026 we classified the mail platform for 479 mail-enabled GTA business domains. 224 ran Microsoft 365. Of those 224, 98.2% published SPF and 54.9% published DMARC, but only 27.2% enforced it and 10.7% were at p=reject. Microsoft 365 tenants usually have the records; they rarely finish the job.
The eight settings
| Setting | Where | Licence |
|---|---|---|
1. MFA for every account | Security defaults or Conditional Access | Security defaults: all plans. Conditional Access: Entra ID P1 (in Business Premium) |
2. Block legacy authentication | Included in security defaults, or a Conditional Access policy | As above |
3. Two emergency access accounts, fewer than five Global Admins, named admin accounts | Entra roles; see emergency access guidance | All plans |
4. Block automatic forwarding to external addresses | Defender portal > outbound spam policy | All plans with Exchange Online |
5. DMARC to enforcement, DKIM on | DNS plus Defender portal DKIM page | All plans |
6. Audit logging confirmed on, with alerts for new inbox rules and admin changes | Microsoft Purview > Audit | Standard audit in most business plans; longer retention needs higher plans |
7. Restrict user consent to third-party apps | Entra > Enterprise apps > Consent and permissions | All plans |
8. Anti-phishing and Safe Links / Safe Attachments | Defender for Office 365 policies | Defender for Office 365 Plan 1 (in Business Premium) |
Why these eight
Each one maps to how business email compromise actually happens in practice. A password is phished or guessed; MFA (1) and legacy blocking (2) stop it being enough. If an attacker gets in, they create a forwarding rule (4) to watch for invoices, or grant consent to a malicious app (7) that keeps access after a password reset. Spoofed mail from your domain to your clients is stopped by DMARC enforcement (5).
Audit logging (6) is what lets you answer the question a lawyer or insurer will ask afterwards: what did they read? Without it, you may have to assume everything. Admin hygiene (3) limits the damage of any single compromised account.
Licence reality for small businesses
Business Basic and Standard give you security defaults, which is enough for settings 1 and 2 but all-or-nothing. Business Premium adds Entra ID P1 for Conditional Access, Intune for device management, and Defender for Office 365 Plan 1. For most offices handling client money or personal information, the upgrade pays for itself the first time it stops a payment-redirection fraud.
If you cannot upgrade everyone, at least license your finance staff, executives and admins, because those are the accounts attackers want.
Do it in this order
- Day one: emergency accounts, then MFA, then legacy authentication.
- Week one: forwarding block, admin clean-up, audit alerts, app consent.
- Weeks two to eight: DMARC from p=none to quarantine to reject, watching reports as you go (DMARC rollout guide).
- Ongoing: review Secure Score monthly and run a user access review each quarter.
Examples from our work
We moved a Mississauga development company from monitor-only DMARC to enforcement and added external sender warnings. For a 40 to 50 person pharmaceutical firm we scoped centralized identity with Entra ID, Intune, Conditional Access and BitLocker, years after reconstructing a mailbox compromise that sent 2,706 emails in 39 minutes.
For a structured review of your tenant, see our Microsoft 365 security assessment or try the Microsoft 365 security check.
Related reading.
- ToolHow secure is your Microsoft 365 tenant?Work through 22 yes or no questions about identity, devices, email, data and monitoring.
- ArticleMulti-Factor Authentication: Why Every GTA Business Needs ItWhich MFA method to use, how to switch it on in Microsoft 365 and Google Workspace, and the awkward cases (shared mailboxes, emergency admin accounts, staff without…
- GuideA baseline set of Conditional Access policiesMost small and mid-sized Microsoft 365 tenants need only a handful of well-tested Conditional Access policies.
- ArticleMicrosoft 365 vs Google Workspace in the GTA: What 479 Business Domains Actually RunOriginal 2026 research: 46.8% of 479 GTA business domains run Microsoft 365 and 25.1% Google Workspace, and the two enforce DMARC at very different rates.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.