Microsoft 365 hygiene checklist: 12 baseline settings to verify.

Most small businesses pay for Microsoft 365 and leave half the built-in protections switched off. This is a self-check list of the baseline settings Microsoft documents publicly — check off the ones your tenant already has on. Nothing you tick leaves your browser.

What this is: a checklist you answer yourself, so you can see which basics are switched on in your own tenant. What it isn't: a security audit, a risk rating, or professional advice. It can't see your tenant, and it doesn't replace an IT professional or a proper security review.

0 of 12 checked

Sign-in protection

Every user can complete multi-factor authentication (MFA). Where to look: Microsoft 365 admin center → Users → Active users → Multi-factor authentication. Everyone with an admin role is required to use MFA. Microsoft lists this as its own Secure Score action — admin accounts are the most valuable targets. Legacy sign-in methods are blocked. Microsoft's security defaults block these automatically; if you use your own Conditional Access policies instead, confirm a block policy exists. One sign-in baseline is switched on: security defaults, or your own Conditional Access policies. The two can't run together — Microsoft says pick one. If neither is on, start here. Admin roles are handed out sparingly. Microsoft's guidance: people should hold only the admin role they actually need — not Global Admin for everyone in IT. Everyday work isn't done from a Global Admin account. Use separate admin accounts for admin tasks; the account you open email with shouldn't be able to reconfigure the tenant.

Email authentication

An SPF record is published for your domain. Where to look: your DNS records; verify in the Microsoft 365 admin center → Settings → Domains. It should authorize Microsoft's mail servers. DKIM signing is turned on for your domain. Where to look: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → DKIM. A DMARC record is published for your domain. Where to look: a TXT record at _dmarc in your DNS. Even a monitoring-only policy (p=none) is a start.

Activity logging & sharing

Activity logging is turned on for the tenant. Microsoft calls this "unified audit logging." Where to look: Microsoft Purview portal → Audit → Start recording user and admin activity. It's on by default for tenants created after 2019 — verify yours. External file-sharing settings were reviewed in the last 6 months. Where to look: SharePoint admin center → Policies → Sharing. Anyone-with-the-link sharing is the loosest option. Guest accounts get a regular tidy-up. Microsoft's Identity Secure Score lists removing dormant accounts from sensitive groups — guests who stopped working with you months ago shouldn't still have access.

Your checklist result

Items checked 0 of 12

Tick the boxes above — your result appears here.

This counts checklist coverage, nothing more. It is not a security rating of your tenant. For Microsoft's own scored view of your tenant, see Secure Score in the Microsoft Defender portal (security.microsoft.com) — that's Microsoft's data about your tenant, and it's free.

Sources

Every item above comes from Microsoft's own documentation: the Microsoft Secure Score recommended actions (MFA for all users, MFA for admin roles, block legacy authentication), the Identity Secure Score recommendations (least-privileged admin roles, remove dormant accounts), the Conditional Access planning guide (security defaults and Conditional Access can't be combined), and the Purview audit-log documentation (turning on unified audit logging). Microsoft changes features and licensing over time — verify each setting's current location in your own admin portals before relying on it.