Microsoft 365 Security Checklist: 15 Settings to Check, in Priority Order

The short version: Do the identity items first: MFA for everyone, two emergency access accounts, legacy authentication blocked, and admin accounts kept separate. Then turn on email protection, read your Secure Score, and confirm audit logging. Finish with the quarterly checks that stop settings drifting. Each item below is one action, one place to check it, and a link to the full guide.

This checklist is for the person who looks after a Microsoft 365 tenant, whether that is an IT manager, an office administrator with admin rights or an outsourced provider. When you finish it you will have a dated list of what is on, what is off and what needs a decision. Menu paths were checked against Microsoft Learn on 28 October 2026. Microsoft moves menus often, so treat a path that no longer matches as a prompt to search the portal.

This week: identity

1. Turn on MFA for every user. Use security defaults if you have no Conditional Access policies, or a Conditional Access policy if you do. Security defaults are set at Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults. Full steps: how to enable MFA in Microsoft 365.
2. Create two emergency access accounts. Microsoft recommends two or more cloud-only accounts with the Global Administrator role, using a passkey (FIDO2), and excluded from Conditional Access policies that block or restrict sign-in. Set them up before you build policies, not after you lock yourself out. See Conditional Access baseline policies.
3. Block legacy authentication. Legacy protocols such as IMAP, POP3 and SMTP basic sign-in cannot do MFA, so an attacker can use them to get around it. Security defaults block them. With Conditional Access, create a policy that blocks the Exchange ActiveSync clients and Other clients conditions, and run it in Report-only first. Check what still uses them at Microsoft Entra admin center > Entra ID > Monitoring & health > Sign-in logs, filtering on Client App, and repeat the filter on the User sign-ins (non-interactive) tab.
4. Keep admin accounts separate. Admins should have one account for administration and another for daily email. Microsoft's security defaults guidance gives the same advice.
5. Roll out the baseline Conditional Access policies. Start in Report-only, then switch on. The six starter policies are in Conditional Access baseline policies.

This month: email, visibility and licences

1. Apply a preset security policy to email. In the Microsoft Defender portal go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies. Standard protection and Strict protection are usually off on your first visit, so assign one to your users. Settings in detail: Exchange Online Protection settings.
2. Set up SPF, DKIM and DMARC for every sending domain. Steps are in the same Exchange Online Protection guide.
3. Decide on Defender for Office 365. If Plan 1 or Plan 2 is already in your licences, switch the features on. If not, decide whether you need it. See Defender for Office 365 Plan 1 vs Plan 2.
4. Read your Secure Score. Open the Microsoft Defender portal at security.microsoft.com/securescore and review the recommended actions and the points each is worth. Each action is worth 10 points or less. Fixing order and limits: how to improve Microsoft Secure Score. For how it differs from CIS and ScubaGear, read Secure Score vs CIS Benchmark vs ScubaGear.
5. List what you pay for and have not switched on. Compare your licences (E3, E5, EMS) with the features in use: Microsoft 365 E3 vs E5 vs EMS security.
6. Confirm audit logging works. Microsoft states that Audit (Standard) is enabled by default and keeps records for 180 days. Open the Audit log search tool in the Microsoft Purview portal, run a search for the last day, and confirm results appear. Your own account needs permission to search it.
7. Know how to send encrypted email. Staff who handle client data should know the steps: how to send encrypted email in Outlook.

This quarter: stop the drift

1. Test the emergency accounts at least every 90 days. Microsoft's guidance is to validate them at least every 90 days, and also after IT staff changes. Confirm each can sign in and that the alert for their use fires.
2. Review the Defender portal weekly. Five places, 15 minutes: Microsoft Defender portal guide.
3. Get an independent review. A second pair of eyes finds what the owner no longer sees. What a review covers and how to scope it: Microsoft 365 security audit cost.

Common mistakes

1. Switching on security defaults while Conditional Access policies exist. The two are alternatives. Microsoft says organisations with Entra ID P1 or P2 licences are probably better served by Conditional Access, and security defaults must be disabled before you replace them with policies.
2. Building Conditional Access without an emergency account. One bad policy can lock out every admin.
3. Treating Secure Score as a pass mark. Microsoft states it shows how far you use recommended controls, not how likely you are to be breached.
4. Blocking legacy authentication without looking first. Scanners, copiers and old mail clients may stop working. Read the sign-in logs for a week in Report-only mode.
5. Ticking items once and never returning. Put items 13 to 15 in the calendar.

How to check it worked

1. In Sign-in logs, open a test user's sign-in and confirm MFA was required.
2. Sign in as the test user from a private browser window and confirm the MFA prompt appears.
3. Open Secure Score and note the score and the date, then compare next month.
4. Record the date of each check in a simple list. That list is what a reviewer will ask for.

FAQ

What is a Microsoft 365 security checklist?

It is an ordered list of settings that reduce the chance of account takeover and email attacks in a Microsoft 365 tenant, with a place to check each one. The list above puts identity first because most other controls depend on it.

What are Microsoft 365 security best practices?

The core ones are MFA for all users, emergency access accounts, blocking legacy authentication, separate admin accounts, email protection policies, audit logging and regular review. Each is an item above.

Is Office 365 security the same as Microsoft 365 security?

Office 365 is one part of Microsoft 365. Most settings in this checklist apply under either name, but the licence you hold decides which features are available.

How often should I review my Microsoft 365 security settings?

Check the Defender portal weekly, the Secure Score monthly and the emergency accounts at least every 90 days. Review everything after a change of IT staff or licences.

Do I need Conditional Access or are security defaults enough?

Security defaults need no extra licence and give a fixed set of protections. If you hold Entra ID P1 or P2 and need exceptions or finer control, Conditional Access is the better fit.

If you would rather have someone check these 15 items against your tenant and report back, see our Microsoft 365 security audit.

Checked against Microsoft Learn, 28 October 2026: security defaults, Microsoft Secure Score, emergency access accounts, blocking legacy authentication, Microsoft Purview auditing, preset security policies.