A Microsoft 365 security checklist for a small Australian business covers seven areas: sign-ins, admin accounts, email, sharing, devices, backup and logging. Many fixes cost nothing extra; Conditional Access, Intune and Microsoft's Defender tools for laptops and email come with Business Premium. Key IT hardens Microsoft 365 tenants for Melbourne businesses, and the table below shows which Essential Eight control each item supports.
Sources checked 22 October 2026.
What belongs on a Microsoft 365 security checklist in 2026?
Fourteen items across seven areas. "Outside the Eight" means the item isn't one of ASD's eight strategies, and "Premium" means Business Basic and Standard don't include it.
| Area | Checklist item | Essential Eight control it supports | Licence |
|---|---|---|---|
| Sign-ins | MFA on every account | Multi-factor authentication | Any plan |
| Sign-ins | Passkeys, admins first, then everyone | Multi-factor authentication (phishing-resistant from Maturity Level 2) | Any plan; enforcing it needs Premium |
| Sign-ins | Legacy authentication blocked | Multi-factor authentication | Any plan |
| Sign-ins | Device code flow blocked | Multi-factor authentication | Any plan; exceptions need Premium |
| Admin | Separate admin accounts with no mailbox; under five Global Administrators | Restrict administrative privileges | Any plan |
| Admin | Two cloud-only break-glass accounts, using passkeys, tested | Restrict administrative privileges | Any plan |
| SPF, DKIM and DMARC staged to reject, including unused domains | Outside the Eight | Any plan | |
| Automatic external forwarding set to Off | Outside the Eight | Any plan | |
| Preset security policy with impersonation protection | Outside the Eight | Impersonation protection: Premium | |
| Sharing | External sharing at the lowest level that works; Anyone links expire | Outside the Eight | Any plan |
| Devices | Intune enrolment; sign-in only from compliant devices | Patching, Office macro settings, user application hardening | Premium |
| Devices | Defender for Business on every laptop | Patching (it finds missing patches) | Premium |
| Backup | Independent backup of mail, files and Teams, with test restores | Regular backups | Separate service |
| Logging | Unified audit log on and verified | Restrict administrative privileges (central logging from Maturity Level 2) | Any plan; over 180 days needs E5 or an add-on |
Security defaults or Conditional Access: which should you use?
Conditional Access if you have Business Premium; security defaults if you don't. Microsoft says security defaults probably aren't right for organisations with Entra ID P1 or P2 licences, and they must be switched off before Conditional Access takes over. Never leave a tenant with neither.
| Compared | Security defaults | Conditional Access |
|---|---|---|
| Licence | None; any plan | Entra ID P1, included in Business Premium |
| When MFA is asked for | Microsoft decides; admins at every sign-in | You set the rules |
| Legacy authentication and device code flow | Both blocked, no exceptions | Blocked by your policies, with named exceptions |
| Device checks | None | Can require a compliant, Intune-managed device |
| Break-glass accounts | Can't be excluded (it's on or off) | Excluded by group |
How do you lock down Microsoft 365 sign-ins?
Turn on MFA for everyone, then close the side doors. Microsoft's guidance on blocking legacy authentication says legacy protocols, which can't do MFA, feature in more than 99 per cent of password spray attacks and over 97 per cent of credential stuffing attacks. For device code flow, Microsoft advises blocking it for nearly everyone and allowing it only in well documented and secured use cases; since 1 July 2026, security defaults block it in every new tenant. Our device code phishing guide explains why MFA alone doesn't stop it.
Next, move to phishing-resistant sign-in. Passkeys (FIDO2) work in every Entra ID edition with no extra licence, and Microsoft's Essential Eight MFA guidance says cryptographic methods like these meet the phishing resistance requirements of Maturity Levels 2 and 3. Our passkeys guide covers the rollout.
How should admin roles and break-glass accounts be set up?
Give each administrator a separate admin account with no Microsoft 365 licence, so it has no mailbox. From Maturity Level 1, the Essential Eight requires privileged accounts to be kept off the internet, email and web services, as Microsoft's admin privileges guidance sets out. Microsoft also recommends fewer than five Global Administrators, with narrower roles for routine work.
Break-glass accounts get you back in if a faulty policy or an MFA outage locks every admin out. Microsoft's emergency access guidance calls for at least two cloud-only Global Administrator accounts on the .onmicrosoft.com domain, using a passkey that differs from your everyday admin sign-in, excluded from Conditional Access policies that block sign-in, alerting someone on every use, and tested at least every 90 days. ASD's Blueprint for Secure Cloud builds the same pair into its baseline.
Which email settings stop spoofing and silent forwarding?
SPF, DKIM and DMARC
Microsoft recommends a gradual DMARC rollout from p=none to quarantine to reject, plus a reject record on domains that never send mail, including onmicrosoft.com if you don't email from it.
Automatic external forwarding
Silent forwarding is a classic sign of a hijacked mailbox. The default, "Automatic - System-controlled", behaves differently between tenants, so Microsoft advises setting On or Off explicitly. Choose Off, with named exceptions.
Preset security policies
Apply the Standard or Strict preset. With Defender for Office 365 Plan 1, included in Business Premium, you also get impersonation protection, Safe Links and Safe Attachments.
Key IT's email security service sets up DKIM, SPF and DMARC, anti-phishing policies and explicit forwarding controls, and puts MFA on every mailbox. Key IT's 24/7 SOC service then keeps watch over sign-ins, newly created inbox rules and forwarding changes.
What should external sharing be set to in SharePoint, OneDrive and Teams?
The lowest level your work allows. The organisation-wide SharePoint setting covers every site, including those behind Teams, and OneDrive can be stricter than SharePoint but never looser, per Microsoft's sharing settings guide. The four levels run from Anyone, where links need no sign-in, down to Only people in your organization. ASD's Blueprint sharing baseline, written mainly for government, uses the last for both SharePoint and OneDrive.
Firms that share with clients can use New and existing guests, with Specific people as the default link. If you must allow Anyone links, make them expire and open view-only: Microsoft notes you can't track who has opened them.
Do you need Intune and Defender for Business?
Yes, if staff use laptops; Business Premium includes both. Microsoft's security guide for its business plans lists Intune, Conditional Access and Defender for Office 365 Plan 1 under Premium only. Defender for Business adds endpoint detection and response and core vulnerability management, which surfaces the missing patches the Essential Eight expects a scanner to find at least fortnightly on workstations.
Intune pushes Windows update rings, Office macro settings and other hardening to each device, and Conditional Access can refuse sign-ins from a laptop that fails its compliance check. Key IT enrols Business Premium clients' laptops in Intune, so a lost one can be locked or wiped remotely. See how Business Basic, Standard and Premium compare.
Is Microsoft 365 a backup?
Not a separate one. Microsoft's Essential Eight backup guidance says customers "always retain responsibility for information and data," and argues that retention inside Microsoft 365 can do much of a backup's job, but all of it stays in your tenant. A permanently deleted email is recoverable for 14 days by default, 30 at most, and SharePoint's recycle bins keep items for 93 days.
The Essential Eight's regular backups control asks, from Maturity Level 1, for backups kept "in a secure and resilient manner" and restores tested in disaster recovery exercises. Key IT's backup and disaster recovery adds an independent, immutable backup of the mail and files in your Microsoft 365 tenant, kept apart from the tenant's recycle bins.
Is your Microsoft 365 audit log switched on?
Check. Microsoft states that auditing isn't enabled by default for Business Basic, Standard or Premium, so someone must turn it on; in Exchange Online PowerShell, UnifiedAuditLogIngestionEnabled should read True. With it off, audit searches return nothing.
Audit (Standard) keeps records for 180 days, and up to a year needs E5 or an add-on, so export the log if you want a longer trail. From Maturity Level 2, the Essential Eight asks for privileged access events to be centrally logged. Sign-in activity is also among the signals Key IT's 24/7 SOC monitoring reviews.
Where does ASD Essentials fit?
ASD released ASD Essentials, the Essential Eight's successor, on 15 October 2026. iTnews reports it will likely take a year or two to become the standard, with the Essential Eight staying on ASD's website meanwhile; its priority phases start with identity services and internet-facing edge devices. ASD advises checking existing controls against Essentials rather than assuming they're equivalent; see our ASD Essentials explainer.
Frequently asked questions
Is Microsoft 365 Business Standard secure enough for a small business?
Partly. Security defaults give Business Standard MFA and block legacy authentication and device code flow, but Conditional Access, Intune, Defender for Business and impersonation protection come with Business Premium, not Standard. Key IT recommends Premium for most Melbourne businesses, after checking what each team uses.
Are security defaults enough for a 10-person business?
Without Business Premium, they're the right baseline: every user registers for MFA, admins are prompted at every sign-in, and legacy authentication and device code flow are blocked. You can't add exceptions or device checks, and the email, sharing, audit and backup items still apply.
Does completing this checklist make us Essential Eight compliant?
No. It covers the Microsoft 365 side of most of the eight controls without completing any of them. Application control, patching every application and server, and the evidence an assessor wants all sit partly outside the tenant, so follow it with an Essential Eight assessment.
Do we still need a backup if we use retention policies?
Key IT's view is yes. Microsoft's own Essential Eight guidance leans on retention inside Microsoft 365, but that data stays in your tenant, within reach of a compromised admin account or a careless policy change. Key IT keeps an independent, immutable copy of Microsoft 365 mail and files, so deleted data can still be brought back.
Will blocking legacy authentication or device code flow break anything?
It can. Copiers and apps that send email with a plain username and password use SMTP basic authentication, which Microsoft says isn't compatible with security defaults, and devices without a keyboard or browser may rely on device code sign-in. Run each Conditional Access policy in report-only mode first, as Microsoft advises, then fix what it catches.
How often should we recheck our Microsoft 365 security settings?
After any change in admin staff or licences, and quarterly otherwise. Microsoft asks for break-glass accounts to be tested at least every 90 days and after IT staff changes, and its defaults keep shifting, as the July 2026 device code change showed.
Can Key IT help secure our Microsoft 365 tenant?
Yes. Key IT manages Microsoft 365 for Melbourne businesses, hardening every tenant with MFA, Conditional Access and monitoring, enrolling Business Premium laptops in Intune and adding independent backup. Managed clients can phone the helpdesk 8am to 5pm on weekdays, with a rotating on-call roster for urgent after-hours issues, and agreements run month to month.
Where do you stand on the Essential Eight? Tick the controls you have in place in a free 60-second self-check.
Take the Self-Check