Most small-business Microsoft 365 breaches don't involve clever malware. They start with one reused password, one legacy app that bypassed MFA, or one inbox rule quietly forwarding mail to a stranger. An admin can shut most of these doors in one afternoon with ten settings.
Here is the checklist we run on client tenants before anything else. If your tenant was configured at setup and never revisited, expect to fail at least four.
1. Block legacy authentication
POP/IMAP/SMTP clients and old scripts can't do MFA — attackers love them for exactly that reason. One Conditional Access rule blocking legacy auth kills more attack paths than anything else here.
2. Enforce MFA for everyone, admins first
Security Defaults is the floor, not the ceiling. At minimum: MFA required for all admin roles and all users. The only exclusion should be a monitored break-glass account.
3. Separate admin accounts from working accounts
Global admin should not read email on the same identity it administers the tenant with. Two to five global admins max, dedicated admin-only accounts, phishing-resistant MFA where possible.
4. Block auto-forwarding to external domains
The business-email-compromise classic: attacker gets in, creates an inbox rule forwarding everything to a lookalike domain, and quietly reads your business for months. One transport rule stops it.
5. Turn on mailbox auditing and the unified audit log
You cannot investigate what you didn't record. Both toggles are off by default in some tenants — verify, don't assume.
6. Review external sharing links
SharePoint/OneDrive "anyone with the link" is convenient and leaky. Set link expiry, restrict to partner domains, audit what's currently shared.
7. Lock down app consent
Users shouldn't consent third-party apps to tenant data. Require admin consent, then review what's already approved — dormant OAuth grants are a favorite persistence trick.
8. Anti-phishing with impersonation protection
Defender for Office 365 Safe Links/Safe Attachments if licensed; at minimum anti-phish policies with executive impersonation protection and external-sender banners.
9. Password policy: length over rotation
Modern guidance (NIST 800-63): 14+ characters, no forced periodic expiry, block breached passwords. Forced 60-day rotations teach users to append "1".
10. Alert policies that a human (or a machine) actually reads
Suspicious inbox rules, impossible travel, mass deletes, new admin assignments — enable the alerts and route them somewhere monitored. An alert to an unmonitored mailbox is a diary, not a control.
Print the list, block one afternoon, work top to bottom. Items 1–4 remove the paths behind most M365 incidents small businesses actually experience.
We package these drills as templates small teams run without a security hire:
- Ops starter pack (IR checklist, backup drill, monitoring templates) — free: https://hive80lab.gumroad.com/l/first-30-minutes
- Full Ops Starter Kit (M365 hardening worksheet, IR, backups, onboarding/offboarding) — $14: https://hive80lab.gumroad.com/l/ops-starter-kit
- Human tenant review with prioritized findings in 5 days — $149: https://hive80lab.gumroad.com/l/ljogci
