The Microsoft 365 security settings a small business should turn on depend on its licence. Every plan has security defaults, built-in email protection and admin controls to check. Business Premium adds Conditional Access, Intune device management and Defender for Business, which need setting up before they protect anything. Work through them in order, and check each one.
I have worked in IT and development since 1998 and hold Microsoft’s Security, Compliance, and Identity Fundamentals certification. Rizonetech is a Microsoft Partner: we transact, deploy and support Microsoft 365 directly. Reviewed 13 October 2026 by Derick Payne.
What security does each Microsoft 365 business licence include?
Start by reviewing what your licence includes, how your tenant is set up today, and the work it will take to change. Some of the biggest improvements use licences you already pay for. Microsoft’s security overview sets out the split:
| Feature | Basic and Standard | Business Premium |
|---|---|---|
| Security defaults (MFA for everyone) | Yes | Yes, until you replace them with Conditional Access |
| Built-in protection against malware, spam and spoofing in email | Yes | Yes |
| Conditional Access (Microsoft Entra ID P1) | No | Yes |
| Basic Mobility and Security (limited device management) | Yes | Yes |
| Device management (Intune Plan 1) | No | Yes |
| Defender for Business (device protection) | No, unless bought separately | Yes |
| Defender for Office 365 Plan 1 (Safe Links, Safe Attachments) | No | Yes |
Microsoft says Business Premium “includes Microsoft Entra ID P1, which includes the feature named Conditional Access”. Basic and Standard already include Basic Mobility and Security, a limited way to manage phones, for example to require a PIN. It supports fewer devices and apps than Intune Plan 1, so read its limits, try it on one phone and check the policy result before relying on it. If you are deciding between Standard and Premium, our Business Standard vs Business Premium guide compares them with current prices.
Which Microsoft 365 security settings apply to every small business licence?
Who holds the admin accounts?
Check this first, because an attacker with an admin account can undo every other setting. Microsoft recommends giving the Global Administrator role to fewer than five people and keeping two cloud-only emergency access accounts. Admins should use a separate account for admin work, not their everyday mailbox. If an IT provider manages your tenant, see who has access on the Partner relationships page of the admin centre; our guide to choosing a managed IT provider explains how to check and remove it.
Is multifactor authentication on for everyone?
On Basic and Standard, security defaults turn it on: every user must register for multifactor authentication (MFA), administrators use it every time, and older sign-in methods that cannot do MFA are blocked. Microsoft says security defaults give “at least a basic level of security enabled at no extra cost”. Microsoft says a tenant created on or after 22 October 2019 “might” have them enabled, so do not assume. Check in the Microsoft Entra admin centre under Entra ID, Overview, Properties, Manage security defaults. Then check that every user has registered a second method. Under security defaults, “Microsoft decides when a user is prompted for multifactor authentication, based on factors such as location, device, role, and task”, so an ordinary sign-in may not ask for it; look in the sign-in log for a sign-in that did require MFA.
Is email protected, and does your domain sign its mail?
All plans include built-in protection against malware, spam and spoofing for cloud mailboxes, on by default. You can make it stricter on any licence: the Standard and Strict preset security policies include anti-spam, anti-malware and anti-phishing policies for “all organizations with cloud mailboxes”. Turn one on in the Defender portal, on the Preset security policies page, and check which users it applies to.
Then check your own domain’s setup: SPF, DKIM signing and DMARC. Publishing DNS records is only half of DKIM: you also switch signing on for the domain in the Defender portal, on the DKIM tab of the Email authentication settings page. Then send a message to an outside mailbox and check its headers for a DKIM pass signed by your own domain.
Our own domain, rizonetech.com, showed this in public DNS on 13 October 2026: two DKIM selector records pointing to Microsoft 365, an SPF record naming only Microsoft 365 and ending in -all, and a DMARC policy of p=none. p=none asks receivers to take no action on failing mail; the record’s rua tag, which ours has, is what asks them to send reports. Our DNS and email security playbook covers each record.
Who can share files outside the business?
Microsoft says external sharing is turned on by default for SharePoint and OneDrive. Decide how far it should go. The most open level, Anyone links, lets anyone with the link open a file without signing in. Many small businesses only need sharing with signed-in guests, and some need none. Set the level in the SharePoint admin centre under Policies, Sharing; it covers OneDrive too. Then test it: try to share a file to an outside address and confirm the result is what you chose.
What does Business Premium add, and how do you set it up?
Most of Premium’s extra protection needs setting up: Conditional Access policies, Intune policies and device onboarding do nothing until you create them. Defender for Office 365’s built-in protection is the exception, on by default. Microsoft’s own Business Premium setup guide runs in this order: set up, configure your security protection, protect personally owned devices, use email more securely, collaborate and share more securely, then set up and secure managed devices.
Conditional Access: what can it do on P1?
Conditional Access policies decide when a sign-in is allowed: require MFA, block older sign-in methods, or require a compliant device. They replace security defaults, so plan the switch. Before you turn security defaults off, set up and test both emergency access accounts: a phishing-resistant sign-in method of their own, credentials stored safely, alerts on every use, and a test sign-in. Exclude them from policies that could block sign-in, and have the new policies ready.
Know the limit of P1. Microsoft says “Risk-based policies require access to Microsoft Entra ID Protection, which is a Microsoft Entra ID P2 feature” (Microsoft Entra licensing). Business Premium includes P1, so policies that react to Microsoft’s detected sign-in or user risk need P2 on top.
Intune: is enrolling a device enough?
No. Enrolment brings a device under management; the policies you create decide what that means. Microsoft recommends a compliance policy for every type of device you enrol, and notes that “The policies aren’t enforced until a corresponding device-based Conditional Access policy is applied to the device.” Work in three steps. Configuration policies push settings such as BitLocker encryption, update rules and screen locks. Compliance policies check that a device has them. Conditional Access then uses the result. Before enforcing, check two things. Intune treats a device with no compliance policy as compliant by default; if you want only compliant devices to reach company data, Microsoft says to set “Mark devices with no compliance policy assigned as” to Not compliant, once every device type has a policy. And with an assigned compliance policy and at least one test device showing as compliant, create the Conditional Access policy that requires a compliant device, scoped to the company computers it should cover, in report-only mode, review its impact, then switch it on.
Personally owned phones are handled differently. They cannot meet a compliant-device requirement without enrolling, so leave them out of that policy and use a separate Conditional Access policy for iOS and Android with the “Require app protection policy” grant control. Test it in report-only mode with a real Outlook sign-in on a personal phone. App protection policies protect company data in apps such as Outlook without enrolling the phone; to remove that data, use app selective wipe. For an enrolled device, Intune’s retire action unenrolls it and removes what Intune deployed, but not necessarily every business file: on Windows, for example, Microsoft 365 Apps stay installed. Microsoft also warns that retiring a BitLocker-protected Entra-joined Windows device suspends BitLocker on the system drive. For a lost company device, a full wipe is the action that resets it. These actions run when the device or app next connects, so a request is not proof that the data is gone. Treat a lost device as a possible security incident, and check what was on it.
Defender for Business: is every device onboarded?
Business Premium includes Defender for Business, but a device is protected only once it is onboarded, by a local script, Group Policy or Intune. Check the device inventory in the Defender portal against your real list of computers. Then run Microsoft’s detection test on an onboarded Windows device, as the onboarding guide says, and confirm the test alert reaches the portal and the person who responds to alerts.
Defender for Office 365: are the presets on?
Premium also includes Defender for Office 365 Plan 1. Its Built-in protection policy “Gives basic Safe Attachments and Safe Links protection” and is on by default. On Premium, the Standard and Strict presets also set Safe Links and Safe Attachments. Check which users each preset covers, and which custom policies or exclusions apply to the rest, because those decide what each mailbox actually gets.
How do you check the settings are working?
- Secure Score. Microsoft describes Secure Score as “a measurement of an organization’s security posture”, in the Defender portal. It lists recommendations for every edition, so ignore the ones your licence cannot use.
- Sign-in logs. Sign in as a test user and confirm the log shows MFA and the Conditional Access policy you expected.
- Device inventory. Compare enrolled and onboarded devices with the computers you actually own.
- Audit log. Turn it on first. Microsoft says “Auditing isn’t enabled by default” for Business Basic, Business Standard and Business Premium (Microsoft Purview). Turn it on in the Microsoft Purview portal; in Exchange Online PowerShell,
UnifiedAuditLogIngestionEnabledreadsTrueonce it is on. Events can take several hours to become searchable, and Audit (Standard) keeps records for 180 days. - Email and sharing. Check a test message’s headers for DKIM and DMARC passes, and repeat the outside-sharing test after any change.
How do we set up Microsoft 365 security for a client?
We read how the tenant is set up and write down what we find before changing anything. Then we switch on the protections the licence already includes, set for how the business works, and set a written process for removing access when someone leaves. At handover the client holds the admin access and a written record of the setup. We work through our own sign-in, documented so it can be removed cleanly. See our Microsoft 365 service for the full scope.
FAQ
Is Business Premium worth it just for security?
It depends on what you would otherwise buy and whether you will configure it. Premium adds device management, device protection, Conditional Access and Defender for Office 365. Only the email protection works without setup; the rest needs configuring before it protects much. Our plan comparison gives the prices.
Can we use Conditional Access on Business Standard?
Not without adding Microsoft Entra ID P1, which Business Premium includes. On Standard, security defaults are the built-in way to require MFA.
Does Microsoft 365 back up our data?
Not the way most people assume. Deleted items are kept for a limited time; our backup guide explains the windows and when to add a separate backup.
What should you do next?
Run the free Microsoft 365 check on your domain to see how its mail and records are set up. Then work through the settings for your licence above, starting with admin accounts and MFA. For the controls outside Microsoft 365, such as updates, backups and payment checks, see our cybersecurity baseline for small businesses. If you are also choosing a licence term, our NCE licensing guide explains monthly and annual commitments.
Published 16 June 2026. Last updated 13 October 2026.