Checklist: a secure Microsoft 365 baseline configuration
For: IT leads in SMEs
Updated: 2026-11
A secure Microsoft 365 baseline covers seven points: multi-factor sign-in for everyone, few and specially protected administrators, legacy sign-in protocols disabled, restricted consent to third-party apps, active logging, SPF, DKIM and DMARC for your domains, and an independent backup of the data.
For many SMEs Microsoft 365 is the most important IT system: email, files, Teams, calendars. Attacks start here accordingly often, usually with taken-over accounts. Most successful attacks exploit not a flaw in Microsoft 365 but a weak configuration.
This checklist describes the baseline every environment should have. It complements the organisational side in the Microsoft 365 governance checklist.
The checklist
- 01
Multi-factor sign-in for everyone
Enforce MFA for all users via security defaults or conditional access policies, without permanent exceptions.
Done when: A report shows all active user accounts signing in with MFA; exceptions are time-limited and justified.
- 02
Limit and protect administrators
Few global administrators, separate admin accounts not used for everyday email, phishing-resistant sign-in for these accounts.
Done when: There are fewer than five global administrators, each with a separate account and phishing-resistant sign-in.
- 03
Disable legacy sign-in protocols
Disable protocols that bypass MFA and block sign-ins using them.
Done when: Sign-in logs show no more successful sign-ins via legacy protocols.
- 04
Restrict consent to third-party apps
Users may no longer grant apps broad rights to email and files themselves; requests go through approval.
Done when: User consent settings are restricted and existing app grants have been reviewed once.
- 05
Enable logging
Enable unified audit logging and mailbox auditing so incidents can be traced.
Done when: A test search in the audit log returns entries from recent days.
- 06
Protect the email domain
Set up SPF, DKIM and DMARC for all sending domains and tighten the DMARC policy step by step.
Done when: SPF, DKIM and a DMARC record are active for every domain and DMARC reports are analysed.
- 07
Back up data independently
Back up business-critical data from Exchange, SharePoint, OneDrive and Teams with a separate solution and test restore.
Done when: A restore of a mailbox and a folder has been carried out and documented.
Common mistakes
- —Introducing MFA but leaving legacy protocols open through which attackers sign in without a second factor.
- —Granting admin rights to personal everyday accounts that open emails and links.
- —Letting users give any app access to mailboxes, a common route for shadow AI and data leakage.
- —Assuming Microsoft backs up your data in the sense of a backup.
What this checklist does not cover
- —The checklist describes a baseline, not a complete security concept; licences determine which features are available.
- —Device security, endpoint protection and networks are not covered.
- —Setting names change as Microsoft 365 evolves.
Parent service: Cyber readiness & IT security
Matching offers
Cyber readiness check
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
Microsoft 365 governance
We develop a governance concept for Microsoft 365: who may create teams and sites, how they are named, classified and archived, how guest access works, which retention and sensitivity rules apply and how Power Automate and Power Apps grow under control. With roles, policies and an implementation plan for your IT.
FAQ
Are Microsoft’s security defaults enough?
For small environments they are a good start. With suitable licences, conditional access policies allow finer control.
How many global administrators make sense?
As few as possible but at least two for cover. Microsoft recommends fewer than five.
How often should this be reviewed?
After every major change and at least annually, together with reviewing guests and app grants.
More checklists
Checklist: submitting a bid for a public tender
Before submission, check seven points: deadline, place and form, completeness of all required documents, validity of evidence of suitability, a price sheet exactly per template without reservations, legally valid signatures, correctly labelled variants and proof of receipt.
Checklist: answering access requests under the Swiss FADP and GDPR
An access request is answered in seven steps: record intake and start the deadline, check identity proportionately, clarify scope, search all systems for data, check restrictions, compile the response with the statutory content and deliver it securely and on time, with documentation.
Checklist: rolling out Microsoft 365 Copilot safely
Copilot is rolled out safely in seven steps: clean up sharing and permissions, classify confidential data, set data loss rules, issue a usage policy, start with a pilot group and clear use cases, train users to check outputs and measure the benefit before expanding.