A new Microsoft 365 tenant is set up to make the first day easy: everyone can sign in from anywhere with a password, mail can be forwarded wherever you like, and nothing is logged for long. Those defaults are fine for a trial and wrong for a business. Here are the twelve changes we make in every tenant we take over, in the order that removes the most risk first.
1. Multi-factor authentication for everyone
Not “available”, enforced. In a small tenant the fastest route is Security Defaults, which require MFA for every user and block the oldest sign-in methods in one switch. On Business Premium, conditional access policies do the same with more control. Either way, no account is exempt, including the owner’s, and the shared mailboxes get it too.
2. A separate admin account, and a break-glass account
The account that reads your mail should not be the account that can delete the company. Create a dedicated global administrator account that is used only for administration, with MFA. Then create one emergency account with a very long password stored offline, excluded from conditional access, so a mistake in a policy cannot lock everyone out. Check it still works every quarter.
3. Block legacy authentication
Old protocols such as POP, IMAP and SMTP basic authentication do not support MFA, and attackers use them to try passwords by the thousand. Blocking them is one policy. If an old scanner or application still needs to send mail, give it its own method rather than reopening the door for everyone.
4. Stop automatic forwarding to outside addresses
The most common thing an attacker does after getting into a mailbox is quietly forward a copy of every message to an address they control, then wait for an invoice to arrive. One setting in Exchange blocks external auto-forwarding for the whole tenant. Turn it on, then check for rules that already exist.
5. Turn on the phishing protections you are paying for
On Business Premium, Safe Links rewrites links so malicious ones are blocked at click time, Safe Attachments opens attachments in a sandbox first, and the anti-phishing policy protects named people from impersonation. On the cheaper plans you have the basic filter only, which is one reason the price difference is worth paying for an office that handles money or client data.
6. Turn on auditing and keep the logs
Mailbox auditing and the unified audit log are off or short by default in some tenants. Turn them on and set retention as long as your plan allows. When something odd happens, the first question is “when did it start”, and without the log there is no answer.
7. Shared mailboxes instead of shared passwords
If three people check info@ by signing in with one password, nobody has MFA on it and nobody knows who sent what. Convert it to a shared mailbox, which has no password at all, and give the three people access through their own accounts.
8. Limit external sharing in OneDrive and SharePoint
The default lets anyone with a link open a file, forever. Set sharing to require sign-in, make links expire, and decide which teams genuinely need to share outside the business. Then search for the anonymous links that already exist.
9. Enroll the devices
On Business Premium, enroll laptops in device management so you can require a PIN, require disk encryption, push updates, and wipe a lost laptop remotely. On other plans, at least turn on disk encryption on every laptop and keep the recovery keys in the admin center.
10. Set retention, and know what it is not
A retention policy keeps deleted mail and files recoverable for a set period, which satisfies most record-keeping needs and saves you when someone deletes the wrong folder. It is not a backup: it lives inside the same tenant, under the same admin accounts, and ransomware that encrypts synced files encrypts the retained copies too.
11. Back up Microsoft 365 separately
A backup you control, outside the tenant, covering mailboxes, OneDrive, SharePoint and Teams, with a restore tested and the date written down. For a ten-person office this costs tens of dollars a month and is the difference between a bad afternoon and a bad quarter.
12. Review the admin center once a month
Ten minutes: the sign-in risk report, accounts that have not signed in for sixty days, new inbox rules, licenses assigned to people who left, and the secure score trend. Put it in the calendar; the tenant drifts if nobody looks.
Day-one checklist
- MFA enforced for every user, including shared mailboxes and the owner
- Dedicated admin account plus an emergency break-glass account, tested
- Legacy authentication blocked
- External auto-forwarding blocked; existing rules reviewed
- Safe Links, Safe Attachments and impersonation protection on (Business Premium)
- Mailbox auditing and unified audit log on, retention set
- Shared mailboxes replace shared passwords
- External sharing limited; anonymous links found and expired
- Laptops enrolled or at least encrypted, keys stored
- Retention policy set and understood
- Separate Microsoft 365 backup running, restore tested and dated
- Monthly admin review in the calendar
The plan question, answered plainly
Business Basic is email and online apps for about $6 per user a month. Business Standard adds the desktop applications for about $12.50. Business Premium adds the security tools in items 5 and 9, and conditional access, for about $22. Prices are Microsoft’s and change occasionally; the gap between Standard and Premium is roughly the cost of a sandwich per person per month, and it buys most of this list.