What is a good Microsoft 365 security baseline for a small or mid-size business?

Key facts

• Identity first: MFA for every user and phishing-resistant methods for admins.
• Keep Global Administrator to two to four named accounts plus two break-glass accounts.
• Business Premium includes Entra ID P1, Intune, Defender for Business and Defender for Office 365 Plan 1.
• Block legacy authentication and automatic external email forwarding.
• A baseline is only real if changes are tested in report-only or pilot mode and then enforced.

The baseline in one list

Most breaches in small and mid-size tenants start with a stolen password, a phishing link or an over-privileged account. The baseline below targets those paths first. It maps well to frameworks such as the CIS Microsoft 365 benchmark, CISA SCuBA baselines and NIST CSF, without requiring an enterprise security team to run it.

• MFA required for all users through Conditional Access, with the Microsoft Authenticator app or passkeys rather than SMS where possible.
• Legacy authentication blocked tenant-wide.
• Separate cloud-only admin accounts, phishing-resistant MFA for admins, and two monitored break-glass accounts.
• Defender for Office 365 preset security policies (Standard or Strict) applied, with Safe Links and Safe Attachments on.
• SPF, DKIM and DMARC configured, with DMARC moved to quarantine or reject once legitimate senders are covered.
• Automatic external forwarding blocked in the outbound spam policy.
• Windows and mobile devices managed by Intune with compliance policies, BitLocker and update rings.
• SharePoint, OneDrive and Teams external sharing limited to what the business needs, with link expiration.
• Unified audit logging on, alert policies reviewed, and sign-in risk watched.
• User consent to third-party apps restricted, with an admin consent workflow.

Which licensing supports it

Microsoft 365 Business Premium is built for organizations up to 300 users and includes most of what this baseline needs: Entra ID P1 for Conditional Access, Intune for device management, Defender for Business for endpoints, Defender for Office 365 Plan 1 for email, and Purview features for sensitivity labels and data loss prevention.

Larger organizations or those needing risk-based Conditional Access, Privileged Identity Management, or advanced hunting usually add Entra ID P2 or move to E5-level security add-ons. Business Standard and Basic plans can still use security defaults, but they lack Conditional Access and Intune, which makes a full baseline hard to enforce.

Roll it out in a safe order

Changing security settings in a live tenant can lock people out or break line-of-business apps. Order the work so the low-risk, high-value items go first and the user-facing items get communication.

Start with admin accounts, break-glass accounts and blocking legacy authentication after checking sign-in logs for anything still using it. Next, turn on MFA for all users with a registration campaign. Then apply email protections, followed by device compliance and sharing limits. Run each Conditional Access policy in report-only mode first and review the results before enforcing.

Keep the baseline from drifting

Baselines decay. New admins get added, exclusions pile up, and Microsoft introduces new features with their own defaults. Assign an owner for each control area and review exceptions on a schedule.

A quarterly check of Global Administrator membership, Conditional Access exclusions, guest accounts, external sharing reports and Secure Score changes catches most drift. Configuration-as-code tools and documented policy exports make it easier to see what changed and when.

Do not forget recovery and people

Prevention is half the baseline. Decide how you would restore deleted mail, files or a compromised mailbox, and test it. Microsoft retention features are not the same as an independent backup, so make that decision deliberately.

Finally, train users on phishing, payment change requests and how to report something suspicious. A simple, well-known reporting path, such as the built-in Report button in Outlook, gives the security team early warning.

How Accred Consulting approaches it

Accred Consulting starts with discovery to see which licenses you have, which controls are already on and what could break. The proposal sets a clear scope, fixed price and timeline for bringing the tenant to a documented baseline. US-based specialists stage Conditional Access in report-only mode, clean up admin roles, enforce email authentication and bring devices under Intune, with structured check-ins along the way. A roughly 350-user manufacturer reached MFA and Conditional Access in 6 weeks this way. Handover includes policy documentation and knowledge transfer, with optional support retainers to keep the baseline from drifting.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions