A Microsoft 365 security baseline for small and mid-sized organisations

The short answer

A baseline covers six areas. Your licences decide the tools: check your plan first.

1. Identity: MFA and blocking legacy sign-in

Legacy authentication (IMAP, POP3 and other older protocols) does not support MFA, so attackers use it to bypass MFA. Before blocking it, check printers, scanners and business applications that still sign in or send mail the old way.

Choose MFA methods that work here. Mobile networks in some locations are unreliable, so SMS codes may arrive late or not at all, and SMS is weaker against SIM-swap fraud. An authenticator app (which generates codes offline) or a security key is more dependable for staff who travel or work from branch offices.

A typical Conditional Access starting set:

• MFA for all users
• Phishing-resistant MFA (passkeys, security keys) for administrators
• Block legacy authentication
• Compliant or managed devices for sensitive data
• Block countries where you have no staff, if that fits

2. Administrator access

Microsoft's guidance for Entra roles (Microsoft Learn):

• Least privilege: roles such as User Administrator or Exchange Administrator, not Global Administrator, for everyday work.
• Global Administrator for fewer than five people; MFA on every administrator account.
• Cloud-only admin accounts, separate from everyday accounts so mail and browsing are not privileged.

3. Email protection

Email is the most common route for phishing and malware. Microsoft's preset security policies (Standard, Strict) apply its recommended anti-spam, anti-malware and anti-phishing settings, plus Safe Links and Safe Attachments with Defender for Office 365, and stay aligned as recommendations change, unlike unreviewed custom policies (Microsoft Learn).

4. Devices

5. Data sharing and backup

• Review SharePoint and OneDrive external sharing: limit "anyone" links, set link expiry, restrict sharing on sensitive sites.
• Use sensitivity labels and data loss prevention where licensed and where you have clear rules to enforce.

Options: pay-as-you-go Microsoft 365 Backup for SharePoint, OneDrive and Exchange, with restore points and configurable recovery windows (Microsoft Learn), or third-party products storing copies outside Microsoft's service. Either way, test restores; see why a backup is not the same as a recovery plan.

6. Monitoring and review

• Secure Score reviewed; decisions on skipped items recorded
• Audit logging on and retained (it helps assess a breach under the Nigeria Data Protection Act 2023)
• Alerts: risky sign-ins, new forwarding rules, new admin roles, emergency account use
• A named alert owner, after hours if needed
• Re-check after licence changes, mergers, major Microsoft changes

Baseline checklist

Limitations

Microsoft changes features, names and licence contents often: confirm against current documentation and pilot changes first. A baseline is a starting point, not a full security programme; it does not replace training, incident response planning or backups outside Microsoft 365. General information, not legal advice. To have it assessed or implemented, see our Microsoft 365 and modern workplace service.

Sources and further reading

Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.

1. Security defaults in Microsoft Entra ID, Microsoft Learn
2. Best practices for Microsoft Entra roles, Microsoft Learn
3. Manage emergency access admin accounts, Microsoft Learn
4. Preset security policies, Microsoft Learn
5. Overview of Microsoft 365 Backup, Microsoft Learn

This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.