Most M365 security checklists are too long to be useful. They list 80 things, half of which require E5 licensing you don't have, and they don't tell you which ones actually matter when something goes wrong. This is the shorter version — the controls that have the most real-world impact, based on what we see in incident response and what auditors actually ask about.
Authentication and Access (Do These First)
MFA is on for all users — not just admins. This sounds obvious in 2026, but we still encounter tenants where MFA is admin-only, or where legacy authentication protocols are still enabled and bypassing MFA entirely. Disable legacy auth via Conditional Access. Full stop.
Admin accounts should use separate, dedicated accounts — not the same account the administrator uses for daily email. Global Admin should have fewer than five holders, ideally using hardware keys (FIDO2) rather than authenticator apps, because authenticator apps can be phished via real-time relay attacks.
Privileged Identity Management (PIM) is worth configuring if you have Azure AD P2 licensing. Just-in-time admin access means nobody is walking around with permanent Global Admin rights — you activate them when needed, with approval, with a time limit. The blast radius of a compromised admin account drops significantly.
Backup and Recovery (The Most Neglected Part)
Independent backup of Exchange, SharePoint, OneDrive, and Teams — stored outside the M365 tenant — is the single most impactful control for data recovery. Microsoft's own service terms explicitly state they don't provide customer data restoration. The 93-day recycle bin is not backup.
Backup to immutable storage (S3 Object Lock or equivalent) so that a compromised admin can't delete your recovery point. Keep backups for at least 90 days of daily snapshots, longer if your compliance requirements demand it. Test a full restore at least quarterly. Log the test results.
Audit Logging and Alerting
Unified Audit Log should be enabled and retained for at least 90 days (1 year with E5 or the audit log retention add-on). Create alerts for: bulk file deletions, admin role assignments, external sharing enabled for sensitive sites, mail forwarding rules created (a common BEC indicator), and MFA disabled for any account.
The forwarding rule alert is particularly important. BEC attackers routinely create inbox rules that silently forward copies of incoming mail to external addresses. This can run for months before anyone notices, during which time the attacker reads all inbound communications and learns enough to impersonate the compromised user convincingly.
External Sharing and Data Classification
Review external sharing settings for SharePoint and OneDrive at least quarterly. The default tenant-level settings are often more permissive than security-conscious organizations realize. Tighten external sharing to require authentication rather than anonymous links. Expiry on shared links (7–30 days) prevents permanently active links from spreading beyond their intended audience.
Sensitivity labels, when applied consistently, let DLP policies fire reliably. Without labels, DLP depends on content pattern matching — which has false positive and false negative rates. A labeling strategy doesn't have to be complex to be effective. Three labels — Internal, Confidential, Restricted — cover most organizations adequately.
Incident Response Readiness
Know who makes the call during an incident. Not in general — have a documented runbook with specific names, phone numbers, escalation paths, and decision authority. Who can authorize a tenant lockdown? Who approves engaging external incident response? Who communicates to the executive team?
Run a tabletop exercise once a year. Pick a realistic scenario — compromised admin credential, ransomware hitting a synced SharePoint library, accidental bulk deletion — and walk through the response. The exercise reveals gaps in your runbook that you won't find any other way.