Most Australian SMEs use Microsoft 365 with default security settings. This is like buying a house with a deadbolt and leaving it unlocked. Microsoft 365 has powerful security tools built in, but most of them are turned off by default. This checklist covers the 15 settings that matter most for businesses with 5-100 employees, organised by priority.
How to Use This Checklist
Critical Items 1-5: Do these immediately. They address the most common attack vectors and take less than half a day combined.
Important Items 6-10: Complete within 2 weeks. These add important layers of protection for data and email.
Nice-to-Have Items 11-15: Complete within 1-2 months. These provide advanced protection and compliance capabilities.
Critical Do These Today
1. Enable Multi-Factor Authentication (MFA) for All Users
What it does: MFA requires a second form of verification (phone app, SMS, or hardware key) in addition to a password when signing in.
How to enable: Go to Microsoft Entra admin centre > Protection > Authentication methods > Policies. Enable Microsoft Authenticator for all users. Then go to Security > MFA > Additional cloud-based MFA settings and enforce MFA.
Why it matters: Microsoft reports that MFA blocks 99.9% of account compromise attacks. Without MFA, a stolen password gives full access to your business email, files, and Teams. This is the single most important security setting you can enable.
Effort: 30 minutes to configure, 5 minutes per user to set up
2. Configure Conditional Access Policies
What it does: Conditional access controls how and where users can sign in. You can block sign-ins from unusual locations, require MFA from untrusted networks, and block legacy authentication protocols.
How to enable: Microsoft Entra admin centre > Protection > Conditional Access > Create new policy. Start with these three policies: (1) Require MFA for all users, (2) Block legacy authentication, (3) Require compliant device for sensitive data access.
Why it matters: Conditional access stops attackers even if they have valid credentials. It also prevents sign-ins from countries where you have no staff, which catches 90% of credential-stuffing attacks against Australian businesses.
Effort: 1-2 hours to configure properly. Requires Azure AD P1 licence (included in Microsoft 365 Business Premium)
3. Restrict Global Admin Roles
What it does: Global admins have unrestricted access to all Microsoft 365 settings. Most businesses give this to too many people. If a global admin account is compromised, the attacker owns everything.
How to enable: Microsoft 365 admin centre > Users > Active users. Review who has Global Administrator role. Reduce to maximum 2-3 global admins. Use specific roles (Exchange admin, SharePoint admin, User admin) for other IT staff.
Why it matters: The 2025 ACSC Annual Cyber Threat Report found that compromised admin accounts were involved in 62% of serious business email compromise incidents in Australia. Fewer admins means fewer attack targets.
Effort: 30 minutes to review and reassign roles
4. Enable Unified Audit Logging
What it does: Audit logging records who did what, when, and where across all Microsoft 365 services. This is essential for investigating incidents and demonstrating compliance.
How to enable: Microsoft Purview compliance portal > Audit > Ensure auditing is turned on (it should be by default, but verify). Set audit log retention to at least 90 days (up to 1 year with E5 or compliance add-on).
Why it matters: Without audit logs, you cannot investigate security incidents, track data access, or demonstrate compliance with the Australian Privacy Act. If something goes wrong, you need to know what happened.
Effort: 15 minutes to verify and configure retention
5. Enable Security Defaults or Equivalent Policies
What it does: Security defaults are a set of pre-configured security settings that Microsoft recommends as a baseline. They include MFA requirements, blocking legacy auth, and protecting privileged accounts.
How to enable: Microsoft Entra admin centre > Properties > Manage security defaults > Enable security defaults. Note: if you use Conditional Access policies (item 2), you should disable security defaults and use Conditional Access instead, as they provide more granular control.
Why it matters: Security defaults protect against the most common identity attacks with zero configuration. They are the minimum viable security for any Microsoft 365 tenant.
Effort: 5 minutes to enable
Important Complete Within 2 Weeks
6. Configure Data Loss Prevention (DLP) Policies
What it does: DLP policies detect and prevent the sharing of sensitive information like credit card numbers, tax file numbers, Medicare numbers, and bank account details via email, Teams, or SharePoint.
How to enable: Microsoft Purview compliance portal > Data loss prevention > Policies > Create policy. Select the "Australia Financial" or "Australia Privacy Act" templates as starting points. Apply to Exchange, SharePoint, OneDrive, and Teams.
Why it matters: Under the Australian Privacy Act, businesses with $3M+ annual turnover must take reasonable steps to protect personal information. DLP policies are considered a "reasonable step" by the OAIC. Without them, staff can accidentally email customer TFNs or bank details to anyone.
Effort: 2-3 hours to configure and test
7. Harden Email Security (Anti-Phishing and Anti-Spam)
What it does: Configure Exchange Online Protection (EOP) and, if available, Microsoft Defender for Office 365 to filter malicious emails, block impersonation attempts, and quarantine suspicious attachments.
How to enable: Microsoft 365 Defender portal > Email & collaboration > Policies > Anti-phishing. Enable impersonation protection for your executives and domains. Set up safe attachments and safe links policies. Configure quarantine notifications so admins review blocked messages.
Why it matters: Email remains the primary attack vector for Australian businesses. The ACSC reported a 23% increase in business email compromise reports in 2025. Proper email security configuration catches 95%+ of phishing attempts before they reach your staff.
Effort: 1-2 hours to configure all email security policies
8. Review SharePoint and OneDrive Sharing Settings
What it does: Control who can share files and with whom. Default settings often allow anyone in the organisation to share files externally, which creates data leakage risk.
How to enable: SharePoint admin centre > Policies > Sharing. Set external sharing to "New and existing guests" (not "Anyone"). Enable link expiration (30-90 days). Require guests to verify identity. Restrict sharing for sensitive sites to specific people.
Why it matters: We regularly audit Microsoft 365 tenants for Australian businesses and find an average of 340 files shared externally, with 15% of those shares no longer appropriate (former clients, ex-employees of partner firms, personal email addresses).
Effort: 1 hour to review and configure
9. Enable and Configure Mobile Device Management (MDM)
What it does: Basic MDM (included in Microsoft 365 Business) lets you require PINs on mobile devices, remotely wipe company data from lost phones, and control which apps can access company email.
How to enable: Microsoft Intune admin centre > Devices > Enrolment. Enable device enrolment for iOS and Android. Create compliance policies requiring: device PIN/passcode, encryption, OS version not too old, not jailbroken/rooted. Create a conditional access policy requiring compliant devices for email access.
Why it matters: If an employee loses their phone or leaves the company, you need the ability to remove company data remotely. Without MDM, your business data sits unprotected on personal devices you have no control over.
Effort: 2-3 hours to set up. Requires device enrolment by each user (10 minutes per device)
10. Configure Email Authentication (SPF, DKIM, DMARC)
What it does: These three DNS records prevent attackers from sending emails that appear to come from your domain. SPF specifies which servers can send email for your domain. DKIM adds a digital signature. DMARC tells receiving servers what to do with emails that fail SPF/DKIM.
How to enable: SPF: Add a TXT record to your DNS. DKIM: Enable in Exchange admin centre > Email authentication > DKIM. DMARC: Add a TXT record to your DNS starting with a "monitor" policy, then move to "quarantine" after 2-4 weeks of monitoring.
Why it matters: Without proper email authentication, attackers can send emails that look like they come from your domain. This is used for invoice fraud (attacker sends fake invoice from your domain to your customers) and phishing (attacker impersonates your CEO to your staff).
Effort: 1-2 hours to configure all three. May need DNS access from your domain registrar
Nice-to-Have Complete Within 1-2 Months
11. Implement Sensitivity Labels
What it does: Sensitivity labels let you classify and protect documents and emails. Labels like "Confidential" or "Internal Only" can automatically encrypt content, add watermarks, and restrict who can access it.
How to enable: Microsoft Purview compliance portal > Information protection > Labels. Create labels (Public, Internal, Confidential, Highly Confidential). Configure auto-labelling for documents containing sensitive information types. Publish labels to all users.
Why it matters: Sensitivity labels make data protection automatic rather than relying on staff judgment. A document labelled "Confidential" stays encrypted even if it is emailed outside the organisation.
Effort: 3-4 hours to design label scheme, configure policies, and train staff
12. Enable Microsoft Defender for Office 365
What it does: Defender for Office 365 adds advanced threat protection beyond basic Exchange Online Protection. It includes safe links (real-time URL scanning), safe attachments (sandboxing), and advanced anti-phishing with AI-powered detection.
How to enable: Requires Microsoft 365 Business Premium or Defender for Office 365 Plan 1/2 licence. Configure in Microsoft 365 Defender portal > Email & collaboration > Policies. Enable safe attachments, safe links, and anti-phishing with mailbox intelligence.
Why it matters: Basic email protection catches known threats. Defender catches zero-day threats and sophisticated phishing that basic filtering misses. For businesses handling sensitive data or financial transactions, this is worth the additional cost.
Effort: 1-2 hours to configure. Additional $3-$5/user/month if not on Business Premium
13. Set Up Compliance Manager and Assessments
What it does: Compliance Manager provides a dashboard showing your compliance posture against various frameworks including the Australian Privacy Act, ISO 27001, and Essential Eight.
How to enable: Microsoft Purview compliance portal > Compliance Manager. Run the default assessment. Review recommendations and prioritise based on your compliance requirements.
Why it matters: Compliance Manager gives you a structured view of your security and compliance posture. It identifies gaps and provides step-by-step remediation guidance. Useful for businesses subject to regulatory requirements or those pursuing ISO certification.
Effort: 2-3 hours for initial assessment review. Ongoing effort depends on findings
14. Configure Idle Session Timeout
What it does: Automatically sign users out after a period of inactivity. This prevents unattended sessions from being exploited, especially on shared or public computers.
How to enable: Microsoft Entra admin centre > Enterprise applications > Office 365 > Properties. Configure idle timeout using a conditional access policy with session controls. Set to 60-120 minutes for standard users, 15-30 minutes for admin accounts.
Why it matters: An unlocked, authenticated session is an open door for anyone with physical or remote access to the device. Idle timeout closes that door automatically.
Effort: 30 minutes to configure
15. Review and Restrict Third-Party App Permissions
What it does: Users can grant third-party applications access to their Microsoft 365 data (emails, files, contacts) through OAuth consent. Many businesses have dozens of third-party apps with access they do not know about.
How to enable: Microsoft Entra admin centre > Enterprise applications > Consent and permissions. Set "Users can consent to apps" to "No" (require admin consent). Review existing consented applications and revoke any that are unnecessary or from untrusted publishers.
Why it matters: Third-party app consent is an increasingly common attack vector. An attacker tricks a user into granting a malicious app access to their mailbox, and the app silently reads all their email. Requiring admin consent prevents this.
Effort: 1-2 hours to review existing apps and configure consent settings
Which Microsoft 365 Plan Do You Need?
Not all security features are available on all plans. Here is what you get at each level:
Microsoft 365 Business Basic ($6/user/month)
MFA and security defaults
Basic Exchange Online Protection (anti-spam, anti-malware)
Audit logging (90-day retention)
No conditional access, no Intune MDM, no Defender, no DLP
Microsoft 365 Business Standard ($12.50/user/month)
Everything in Basic
Desktop Office apps
Same security limitations as Basic
Microsoft 365 Business Premium ($22/user/month) — Recommended
Everything in Standard
Conditional access policies
Microsoft Intune (full MDM)
Defender for Office 365 Plan 1
Azure Information Protection (sensitivity labels)
Data Loss Prevention
For most Australian SMEs, Business Premium is the right choice. The $10/user/month premium over Standard pays for itself if it prevents even one security incident. A single business email compromise costs Australian businesses an average of $39,000 according to the ACSC.
Common Mistakes We See
- MFA enabled but not enforced: Staff are "encouraged" to use MFA but it is optional. This means the accounts most likely to be targeted (those of less tech-savvy staff) are unprotected
- Legacy authentication still allowed: Older email protocols (POP3, IMAP, SMTP) bypass MFA entirely. If legacy auth is enabled, MFA provides no protection for those connections
- Sharing links set to "Anyone": Default SharePoint sharing creates anonymous links that anyone with the URL can access. These links get forwarded, bookmarked, and indexed
- No admin account separation: The business owner uses their daily email account as the global admin. If that account is compromised, the attacker has admin access to everything
- Audit logging not checked: Audit logging is enabled but nobody reviews the logs. Set up alerts for suspicious sign-in activities and admin actions
For a broader view of cybersecurity risks facing small businesses, read our guide on cybersecurity risks for small businesses. To discuss migrating your business to Microsoft 365 or upgrading your current configuration, see our Microsoft 365 integration services or check our Office 365 migration FAQ.
Need Help Securing Your Microsoft 365?
We audit and configure Microsoft 365 security for Australian SMEs. Our security review covers all 15 checklist items plus tenant-specific recommendations. Most configurations can be completed in a single day.