The 12 checks in this quiz
Answer each one No, In progress, or Yes. Anything not fully in place comes with a concrete next step.
Identity & MFA
-
Is MFA enforced for all users, not just admins?
Enforce MFA for every user via Conditional Access or security defaults; protecting admins alone leaves most accounts exposed.
-
Have you blocked legacy authentication, the protocols that bypass MFA?
Block legacy authentication in Entra ID; it is a common way attackers slip past MFA.
-
Do you use Conditional Access policies (or security defaults) to control risky sign-ins?
Use Conditional Access (Business Premium) or at least security defaults to challenge risky or unfamiliar sign-ins.
Admin & roles
-
Are global admins kept to a few, each with a separate admin account?
Keep global admins to a minimum and give admins a separate account from their day-to-day login.
-
Do you review who has admin or elevated roles periodically?
Review admin and elevated roles on a schedule and remove access nobody still needs.
Access & sharing
-
Is external sharing and guest access in SharePoint, OneDrive and Teams controlled?
Tighten external sharing defaults so files and Teams are not open to anyone with a link by accident.
-
Do you control which third-party apps users can consent to and connect to the tenant?
Restrict user app consent so staff cannot grant random third-party apps access to company data.
Threat protection
-
Do you have email threat protection beyond the basics, such as anti-phishing and safe links?
Turn on anti-phishing, Safe Links and Safe Attachments (Defender for Office 365) to catch what the basics miss.
-
Do you monitor alerts and sign-in logs, or would a compromise go unnoticed?
Make sure someone watches the security alerts and sign-in logs, so a compromised account is caught quickly.
-
Have you checked your Microsoft Secure Score and acted on the top recommendations?
Open Microsoft Secure Score and work through the highest-impact recommendations; it is a free, built-in roadmap.
Data & backup
-
Do you back up Microsoft 365 (mail, OneDrive, SharePoint) beyond the default retention?
Add third-party Microsoft 365 backup; Microsoft protects its service, but recovering your deleted or ransomed data is on you.
-
Are retention and basic data-loss prevention (DLP) policies in place for sensitive data?
Set retention and basic DLP policies so sensitive data is kept, and not shared out, appropriately.
Your Microsoft 365 is only as secure as its settings
Microsoft 365 ships open by default, and most small businesses never change that. We harden Microsoft 365 tenants for Canadian businesses, MFA and Conditional Access, admin hygiene, sharing controls, threat protection and backup, then keep them tuned as Microsoft and the threats change.