Microsoft 365 Setup Checklist for Small Businesses
Microsoft 365 works out of the box, but out of the box is not the same as set up properly. These are the settings that protect a small business, keep email out of spam folders and line up with Cyber Essentials.
1. Choose the right licences
Business Basic covers web and mobile apps, email and Teams. Business Standard adds the desktop Office apps. Business Premium adds device management through Intune, advanced threat protection through Defender for Business and Conditional Access. If you handle sensitive client data or want central control of laptops and phones, Premium is usually worth it. You can mix licences across staff.
2. Turn on multi-factor authentication for everyone
MFA is the single most effective setting in Microsoft 365, and Cyber Essentials requires it on all cloud services. Business Premium lets you use Conditional Access policies. On other plans, security defaults enforce MFA across the tenant. Encourage the Microsoft Authenticator app or passkeys over text messages.
3. Separate admin accounts
- Give administrators a separate admin account that is not used for email or browsing.
- Keep the number of global administrators to a minimum, typically two.
- Create an emergency access account with a long password stored securely, excluded from policies that could lock everyone out.
4. Authenticate your email domain
Three DNS records tell other mail servers your email is genuine. Without them, invoices and proposals land in spam, and it is easier for fraudsters to send email that appears to come from you.
| Record | What it does | What to set |
|---|---|---|
| SPF | Lists the services allowed to send email for your domain | Include Microsoft 365 and any other senders, such as your invoicing or marketing tools |
| DKIM | Digitally signs outgoing email | Enable DKIM signing for your domain in Microsoft Defender |
| DMARC | Tells receivers what to do with email that fails checks, and sends you reports | Start with monitoring, then move to quarantine or reject once reports show only legitimate senders |
Email authentication records for a Microsoft 365 domain
SPF
- What it does
- Lists the services allowed to send email for your domain
- What to set
- Include Microsoft 365 and any other senders, such as your invoicing or marketing tools
DKIM
- What it does
- Digitally signs outgoing email
- What to set
- Enable DKIM signing for your domain in Microsoft Defender
DMARC
- What it does
- Tells receivers what to do with email that fails checks, and sends you reports
- What to set
- Start with monitoring, then move to quarantine or reject once reports show only legitimate senders
5. Set sensible sharing defaults
Decide whether files can be shared with people outside the business, and how. For most small businesses, sharing with specific named people is safer than "anyone with the link". Review who has access to shared sites and Teams before introducing Copilot, which can surface anything a user already has permission to open.
6. Manage devices and updates
With Intune you can require screen locks, disk encryption and up-to-date operating systems before a device can reach company data, and wipe company data from a lost phone. These controls map directly to the secure configuration and security update requirements in the Cyber Essentials checklist.
7. Plan for backup and retention
Microsoft keeps the service running, but under its shared responsibility model protecting your data is your job. Retention policies and the recycle bin are not a full backup. Consider a third-party backup for mailboxes, OneDrive and SharePoint, especially if deleted or encrypted data would be costly to lose.
8. Write down joiners and leavers
- Who approves a new account, and which licence and groups it gets.
- Who disables the account on the leaving date, and what happens to the mailbox and files.
- Who removes admin rights when someone changes role.
Common questions
Do we need Business Premium for Cyber Essentials?
No. Cyber Essentials can be met on other plans, but Business Premium makes device management and MFA enforcement much easier to prove and maintain.
Is Microsoft 365 in scope for Cyber Essentials?
Yes. Under the v3.3 requirements, cloud services that store or process your data cannot be excluded, and they must use multi-factor authentication.
