Microsoft 365 for a Small Office: Setup and Security Essentials

Most small offices sign up for Microsoft 365, add users, and move on. The defaults have improved a lot, but a few decisions only you can make: who holds the keys, how people sign in, whether your email can be spoofed, and what happens when someone leaves. This guide covers those decisions in the order I'd tackle them.

It's based on Microsoft's current documentation (linked throughout), not on a particular client's setup. Admin center menus move from time to time; if a path doesn't match, search the admin center for the setting's name.

Which plan, and what it changes#

Microsoft 365 business plans differ mostly in apps and security features:

Microsoft also sells Business Standard and Business Premium "with Copilot" bundles; the security features described here come from the underlying plan. Microsoft designs Business Premium for organizations of up to 300 users. You can mix plans: for example, Premium for people who handle sensitive data and Basic for occasional users. Check current pricing with Microsoft or your reseller; it isn't listed here because it changes.

1. Admin accounts and emergency access#

Whoever created the tenant is a Global Administrator, and that account often doubles as someone's everyday mailbox. Separate them:

• Use a separate admin account (for example admin-yourname@yourdomain.com) for administration, and a normal account for daily email. A phishing email that compromises your everyday account then doesn't hand over the whole tenant.
• Keep Global Administrators to a minimum. Microsoft recommends fewer than five. Use narrower roles where they fit: Exchange Administrator for mail, User Administrator for accounts, Billing Administrator for invoices.
• Create two emergency access ("break-glass") accounts. Microsoft recommends two or more cloud-only accounts on your *.onmicrosoft.com domain, permanently assigned Global Administrator, not tied to any one person or phone. Protect them with a passkey (FIDO2 security key) that's different from your normal sign-in method. Store the keys and passwords somewhere safe and separate, such as a fireproof safe. Then set up an alert for every sign-in to them, and test that they work at least every 90 days.

2. Turn on multifactor authentication for everyone#

Multifactor authentication (MFA) is the single most effective protection for Microsoft 365 accounts. Microsoft already requires MFA to sign in to the Microsoft 365 admin center and other admin portals. Extend it to every user:

• Business Basic or Standard (no Entra ID P1): turn on security defaults. They're free and require everyone to register for MFA, require MFA for admins every time, block legacy sign-in protocols that can't do MFA, and block device code sign-in. Path: Microsoft Entra admin center → Entra ID → Overview → Properties → Manage security defaults. Many newer tenants already have them on.
• Business Premium: use Conditional Access instead (security defaults must be off). Microsoft provides managed policies that match security defaults as a starting point, and you can add rules such as requiring a compliant device.

Tell people what's coming before you turn it on. They register at myprofile.microsoft.com → Security info, ideally with the Microsoft Authenticator app.

3. Stop people spoofing your email: SPF, DKIM, and DMARC#

These three DNS records let receiving mail servers check that mail claiming to be from your domain really came from you. They're also increasingly required by large mailbox providers. (For how DNS records fit together, see the website hosting guide.)

4. Use shared mailboxes instead of shared passwords#

Addresses like info@ or office@ are best as shared mailboxes, not as an extra user whose password everyone knows:

• A shared mailbox needs no license for up to 50 GB of mail.
• People open it from their own account, so each person still signs in with their own MFA, and you can see who has access.
• Keep sign-in blocked on the shared mailbox's account; Microsoft says it isn't meant for direct sign-in.
• Microsoft lists a maximum of 25 users for a shared mailbox, and people outside your organization can't be given access. Use a Microsoft 365 group for those cases.

Example: website notifications without a stored mailbox password#

A common small-office need is a website form or business app that sends email. The old approach, an SMTP username and password saved in the website's settings, stops working once basic authentication is blocked, and it hands the website a full mailbox password.

This website's Request Help form takes a different route. It sends each new request to the office's shared mailbox through Microsoft Graph, and nothing on the website could sign in to a mailbox:

1. A dedicated app registration in Microsoft Entra ID, used only by the website, with no Microsoft Graph API permissions granted in Entra ID. In particular, there's no tenant-wide Mail.Send.
2. Exchange Online RBAC for Applications gives that app the Application Mail.Send role, limited by a management scope to one shared mailbox. The app can send as that mailbox and no one else (Microsoft Learn).
3. The website's server code gets a short-lived token for the app and calls Graph to send the message from the shared mailbox, with the customer's address as the reply-to.
4. The app's secret is stored only in the hosting provider's encrypted environment settings, never in the code or a document, and must be rotated before its expiry date.
5. Checked before going live: Exchange's authorization test showed the app in scope for the one shared mailbox and out of scope for every other mailbox.

The scoping commands look like this (placeholders in angle brackets; run in Exchange Online PowerShell as an Exchange administrator). Record what's already there first, so you can compare and undo:

Get-ServicePrincipal | Format-List DisplayName, AppId, ObjectId
Get-ManagementScope | Format-List Name, RecipientFilter
Get-ManagementRoleAssignment -Role "Application Mail.Send" | Format-List Name, RoleAssignee, CustomResourceScope

New-ManagementScope -Name "Website mailer scope" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'notifications@yourdomain.com'"
New-ServicePrincipal -AppId <application-id> -ObjectId <enterprise-app-object-id> -DisplayName "Website mailer"
New-ManagementRoleAssignment -App <enterprise-app-object-id> -Role "Application Mail.Send" -CustomResourceScope "Website mailer scope"
Test-ServicePrincipalAuthorization -Identity "Website mailer" -Resource notifications@yourdomain.com

5. Decide how files can be shared#

OneDrive and SharePoint make sharing easy, sometimes too easy. In the SharePoint admin center → Policies → Sharing, choose the most restrictive level that still lets you work:

• Only people in your organization if you never share files externally.
• Existing guests or New and existing guests if you share with clients but want them to sign in.
• Anyone links only if you really need them, with an expiration set so old links stop working.

Review external sharing once a quarter, especially after a project or staff change.

6. Protect devices#

• Encrypt laptops: BitLocker on Windows, FileVault on Mac.
• Keep Windows and Office updating automatically, and replace devices that no longer get security updates.
• Business Premium: enroll company devices in Intune so you can require encryption and updates, and wipe company data from a lost device. Defender for Business adds endpoint detection and response.

7. Backups and retention#

Microsoft keeps the service running and has recycle bins and restore options (OneDrive can roll back to an earlier point in time). That isn't the same as an independent backup. If an account is compromised, a file is deleted and the deletion isn't noticed in time, or someone leaves and their data is removed, recovery depends on how long those options keep data.

• Review the retention settings for mail, OneDrive, and SharePoint.
• If losing email or file history would hurt the business, add a dedicated Microsoft 365 backup (Microsoft offers one, and several third-party services do too).
• The 3-2-1 backup guide explains how this fits into a wider plan.

8. Onboarding and offboarding#

Most small-office incidents start with an account that should have been closed or a password that was shared. Write these steps down and follow them every time.

When someone joins:

1. Create the account and license

   Create the user with a temporary password, assign the right plan, and add them to the groups and shared mailboxes they need, and no more.

2. MFA on the first day

   Have them register MFA at myprofile.microsoft.com before they start using email.

3. Device ready

   Encrypted, updated, and (with Business Premium) enrolled in Intune.

When someone leaves (do this on their last day, in this order):

1. Block sign-in and end sessions

   In the Microsoft 365 admin center, block sign-in for the user and sign them out of all sessions. Reset the password.

2. Keep the mail

   If others need the mailbox, convert it to a shared mailbox and give the right people access, or forward new mail to a manager for a set period.

3. Move the files

   Give a manager access to the person's OneDrive and move anything the business needs to a SharePoint site. Don't count on automatic access: when an account is deleted, Microsoft gives the manager access to its OneDrive (30 days by default to download what's needed) only if access delegation is turned on and a manager or secondary owner is set; otherwise no one gets access automatically. OneDrive cleanup starts only when the account is deleted, not when sign-in is blocked or the license is removed.

4. Remove access everywhere else

   Remove them from groups, shared mailboxes, and admin roles; collect company devices and wipe or reassign them; change any shared passwords they knew.

5. Remove the license last

   Only after mail and files are safe, remove the license and later delete the account. If an account stays in Entra ID without a license, Microsoft's unlicensed OneDrive rules apply: the OneDrive becomes read-only after 60 unlicensed days and is archived after 93, and from then on neither you nor the user can open its files until you assign a license, enable billing, or reactivate it. Archived accounts incur storage charges only if billing for unlicensed OneDrive accounts has been enabled; without it, an unlicensed account is on a cumulative 365-day nonpayment clock, after which it can be deleted. A deleted account's OneDrive follows the separate deletion and retention process instead.

9. A small Exchange Online PowerShell toolkit#

The admin centers do everything above, but PowerShell is faster for checking settings across all users. These commands use the Exchange Online PowerShell module (version 3.10 and later needs PowerShell 7.6, or use Windows PowerShell 5.1). Use version 3.10.1 or later: Microsoft plans stricter sign-in requirements from March 31, 2027, after which older versions may fail to sign in in some interactive cases. Everything in this section only reads settings. The scoping example in section 4, and the undo commands listed with it, are the only commands in this guide that change anything.

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Get-Module ExchangeOnlineManagement -ListAvailable   # check the version: 3.10.1 or later
Connect-ExchangeOnline -UserPrincipalName admin-yourname@yourdomain.com
Get-ConnectionInformation          # confirms the tenant you're connected to

Get-EXOMailbox -ResultSize Unlimited | Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails
Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited

Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress
Get-InboxRule -Mailbox someone@yourdomain.com | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }

Get-DkimSigningConfig | Format-List Name, Enabled, Status, Selector1CNAME, Selector2CNAME
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

Disconnect-ExchangeOnline -Confirm:$false

More everyday commands are in the PowerShell Essentials cheatsheet.

Common mistakes#

• One person's everyday mailbox is the only Global Administrator. If that person leaves or their phone is lost, nobody can manage the tenant.
• No emergency account, or one nobody has tested since it was created.
• MFA for some users only. Attackers look for the one account without it.
• Two SPF records, or a DMARC reject policy set before checking which services send as the domain.
• Shared logins for info@ instead of a shared mailbox.
• "Anyone" links that never expire.
• Offboarding by deleting the account before saving the person's mail and files.
• Assuming Microsoft's recycle bins are a backup.

Next steps#

1. Create a separate admin account and two emergency accounts, then test them.
2. Turn on security defaults or Conditional Access, after checking for older devices that send email.
3. Publish SPF, enable DKIM, and start DMARC at p=none.
4. Write down your offboarding steps.
5. Work through the Small Business Cybersecurity Checklist for everything outside Microsoft 365.