Microsoft 365 Security Setup for Small Business
Most small offices run their whole business on Microsoft 365. Email, files, Teams, all of it. The settings that protect it are not always on, and nobody told you which ones to check.
I review Microsoft 365 remotely. Here is the list I start with, and the kit below puts the matching policies on paper.
Eight Microsoft 365 settings to check first
Check what is actually on, not what you think is on.
- MFA for every user. Not just the owner. Email is the first thing attackers go after.
- Protect admin accounts. Use a separate admin login that does not read email, and keep the number of admins small.
- Block old sign in methods. Older protocols skip MFA, so turn them off if you do not need them.
- Email protection. Turn on anti phishing, safe links and attachment scanning. Check which plan you have, because some of this comes with Business Premium.
- Limit outside sharing. Decide who can share files outside the company, and expire guest links.
- Device rules. Require a passcode and encryption on phones and laptops that touch company data.
- Turn on audit logging. If something goes wrong, the logs tell you what happened.
- Check Secure Score. It is a built in report in Microsoft 365 that lists what to fix next.
Which Microsoft 365 plan do you need?
Business Basic and Business Standard cover email, files and Teams. Business Premium adds Microsoft Defender for Business and device management through Intune. Many small offices that handle client data end up on Premium because the extra protection is built in.
If you already pay for a plan, the first step is to see what you own and what is turned on. You may have tools you never switched on.
Two ways to get it done
Do it yourself. The Security Readiness Kit below includes policies for password and MFA, email and phishing, device use and vendor access, written in plain English. The Professional Kit adds a 30 day implementation guide.
Have me check it. I review your Microsoft 365 settings, devices and backups remotely and give you a written list of what passes and what to fix. If you need the results for a cyber insurance application, the Cyber Insurance Readiness Check is a fixed price by seat count. Ask for a quote at lonestarcomputersecurity.com.
Insurers ask about Microsoft 365 more every year. See the cyber insurance renewal questionnaire for the questions, or go back to the small business cybersecurity checklist.
Watch the 30 second overview
Two ways to get ready: do it yourself with the kit, or have me check your setup.
Frequently asked questions
How do I secure Microsoft 365 for my small business?
Start with MFA for every user, protect admin accounts, turn on email protection, limit outside sharing and turn on audit logging. The list above covers the first eight settings.
Is Microsoft 365 secure out of the box?
Not fully. It gives you a lot of tools, but many protections depend on your plan and on settings someone has to turn on. Check your settings instead of assuming.
Do I need Microsoft 365 Business Premium?
Not always. Business Premium adds Defender for Business and device management through Intune. If your staff handle client records, bank data or health data, the extra protection is usually worth a look.
Can you set up Microsoft 365 security for me?
I review your settings remotely and give you a written list of what to fix. I can walk you through the changes. I do not do on site work.
Does the kit change my Microsoft 365 settings?
No. The kit is a set of Word templates for policies and checklists. It tells you what to decide and what to write down. You or your IT person make the changes in Microsoft 365.
Start Today With a Security Readiness Kit
Prefer to work at your own pace? Our editable Word templates put your policies and checklists on paper in plain English. Every tier includes an explainer video.
Starter Kit
Ten ready to customize security policies and four checklists, as editable Word templates in plain English.
Buy the Starter KitProfessional Kit
Everything in Starter, plus a cyber insurance readiness checklist pack and a 30 day implementation guide.
Buy the Professional KitComplete Kit
The full kit, plus HIPAA and WISP template add on packs and IRS references for tax preparers.
Buy the Complete KitSee every document in each tier in the full Security Kit details.
Templates only, not legal advice. Digital download. All sales are final, no refunds.
Talk to Scott
Call 469-248-5463. Remote service for DFW, Texas and anywhere in the US. Scott has 28 years in IT and holds CompTIA Security+ CE.