# Microsoft 365 for a Small Office: Setup and Security Essentials

This is a plain-text copy of a guide published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/microsoft-365-small-office-guide

- Source (authoritative web version): https://jeremiahellington.com/resources/microsoft-365-small-office-guide
- Author: Jeremiah Ellington
- Published: 2026-10-27
- Last updated: 2026-10-27
- Last reviewed: 2026-10-27
- Next scheduled review: 2027-04-30
- Applies to: Microsoft 365 Business Basic, Business Standard, and Business Premium (cloud-only tenants). Checked against Microsoft Learn documentation on 2026-10-27, not tested in a live tenant. Exchange Online PowerShell module 3.10.1 or later on PowerShell 7.6 or Windows PowerShell 5.1
- Who it's for: Owners, office managers, and part-time IT people at offices of roughly 2–25 people that use Microsoft 365 for email and files.
- Level: Beginner to intermediate
- Before you start: A Global Administrator account for your Microsoft 365 tenant; Access to your domain's DNS settings (at your registrar or DNS host); An authenticator app on your phone; ideally two FIDO2 security keys for emergency accounts

The settings that matter most when a small office runs on Microsoft 365: admin and emergency accounts, MFA, email authentication, shared mailboxes, sharing, backups, onboarding and offboarding, plus a short Exchange Online PowerShell toolkit.

---

Most small offices sign up for Microsoft 365, add users, and move on. The defaults have improved a lot, but a few decisions only you can make: who holds the keys, how people sign in, whether your email can be spoofed, and what happens when someone leaves. This guide covers those decisions in the order I'd tackle them.

It's based on Microsoft's current documentation (linked throughout), not on a particular client's setup. Admin center menus move from time to time; if a path doesn't match, search the admin center for the setting's name.

> **Note:**
> **Checked against Microsoft Learn documentation, not tested in a live tenant.** Every admin step, plan name, portal path and command here was re-checked against Microsoft's documentation on October 27, 2026. Nothing in this guide was run or tested in a Microsoft 365 tenant. Section 4's website-notification example describes this site's own email setup, which was done separately.

> **Important:**
> Make changes one at a time, at a quiet time, and keep a second admin sign-in ready (an emergency account, below) before you change anything about how people sign in.

## Which plan, and what it changes

Microsoft 365 business plans differ mostly in apps and security features:

| Plan | What it adds | Good fit |
|---|---|---|
| **Business Basic** | Email (Exchange Online), Teams, OneDrive, SharePoint, and the web and mobile Office apps | Offices that work mainly in a browser |
| **Business Standard** | Everything in Basic, plus the desktop Office apps | Most offices that use Word, Excel, and Outlook on PCs |
| **Business Premium** | Everything in Standard, plus device management (Intune), Conditional Access (Microsoft Entra ID P1), and [Microsoft Defender for Business](https://learn.microsoft.com/en-us/defender-business/mdb-overview) for devices | Offices with sensitive data, laptops that leave the office, or cyber-insurance requirements |

Microsoft also sells Business Standard and Business Premium **"with Copilot"** bundles; the security features described here come from the underlying plan. Microsoft designs [Business Premium](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-security-benefits) for organizations of up to 300 users. You can mix plans: for example, Premium for people who handle sensitive data and Basic for occasional users. Check current pricing with Microsoft or your reseller; it isn't listed here because it changes.

## 1. Admin accounts and emergency access

Whoever created the tenant is a Global Administrator, and that account often doubles as someone's everyday mailbox. Separate them:

- **Use a separate admin account** (for example `admin-yourname@yourdomain.com`) for administration, and a normal account for daily email. A phishing email that compromises your everyday account then doesn't hand over the whole tenant.
- **Keep Global Administrators to a minimum.** Microsoft recommends [fewer than five](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices). Use narrower roles where they fit: Exchange Administrator for mail, User Administrator for accounts, Billing Administrator for invoices.
- **Create two emergency access ("break-glass") accounts.** Microsoft recommends [two or more cloud-only accounts](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access) on your `*.onmicrosoft.com` domain, permanently assigned Global Administrator, not tied to any one person or phone. Protect them with a **passkey (FIDO2 security key)** that's different from your normal sign-in method. Store the keys and passwords somewhere safe and separate, such as a fireproof safe. Then **set up an alert for every sign-in to them**, and **test that they work at least every 90 days**.

> **Warning:**
> If you later create Conditional Access policies, exclude the emergency accounts from policies that **block or restrict** sign-in. Otherwise the accounts meant for a lockout can be locked out too.

## 2. Turn on multifactor authentication for everyone

Multifactor authentication (MFA) is the single most effective protection for Microsoft 365 accounts. Microsoft already requires MFA to sign in to the [Microsoft 365 admin center](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication) and other admin portals. Extend it to every user:

- **Business Basic or Standard (no Entra ID P1):** turn on [security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults). They're free and require everyone to register for MFA, require MFA for admins every time, block legacy sign-in protocols that can't do MFA, and block device code sign-in. Path: **Microsoft Entra admin center → Entra ID → Overview → Properties → Manage security defaults**. Many newer tenants already have them on.
- **Business Premium:** use **Conditional Access** instead (security defaults must be off). Microsoft provides managed policies that match security defaults as a starting point, and you can add rules such as requiring a compliant device.

> **Caution:**
> Security defaults block **legacy authentication**, including older scanners, copiers, and apps that send email with just a username and password (basic SMTP authentication). Check for these first. Microsoft's guide to [setting up multifunction devices](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365) explains the alternatives.
>
> Even without security defaults, Microsoft is retiring **basic authentication** for SMTP AUTH, the username-and-password method. SMTP AUTH itself isn't going away: it also [supports OAuth](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission), which isn't affected. Microsoft has updated the retirement timeline, so check [Microsoft's latest announcement](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online) for the current dates. Move devices and apps to OAuth or one of the alternatives above now, rather than waiting for the cutoff.

Tell people what's coming before you turn it on. They register at **myprofile.microsoft.com → Security info**, ideally with the Microsoft Authenticator app.

## 3. Stop people spoofing your email: SPF, DKIM, and DMARC

These three DNS records let receiving mail servers check that mail claiming to be from your domain really came from you. They're also increasingly required by large mailbox providers. (For how DNS records fit together, see the [website hosting guide](https://jeremiahellington.com/resources/small-business-website-hosting-guide).)

| Record | What it does | For Microsoft 365 |
|---|---|---|
| **SPF** (TXT) | Lists the servers allowed to send for your domain | `v=spf1 include:spf.protection.outlook.com -all`, plus any other services that send as your domain. Exactly **one** SPF record per domain |
| **DKIM** (two CNAMEs) | Lets Microsoft 365 sign outgoing mail with your domain | Created in the **Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM** (security.microsoft.com/authentication). Copy the two CNAME values shown there; they're specific to your tenant |
| **DMARC** (TXT at `_dmarc`) | Tells receivers what to do when SPF and DKIM don't line up with the From address, and where to send reports | Start with `p=none` and a reporting address, then move to `quarantine`, and later `reject` once reports show only legitimate mail |

> **Caution:**
> Before you tighten DMARC, list **every** service that sends email as your domain: newsletter tools, invoicing and booking systems, website forms, copiers. Each needs to pass SPF or DKIM, or its mail will start landing in spam (`quarantine`) or bouncing (`reject`).

## 4. Use shared mailboxes instead of shared passwords

Addresses like `info@` or `office@` are best as [shared mailboxes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes), not as an extra user whose password everyone knows:

- A shared mailbox needs **no license** for up to 50 GB of mail.
- People open it from their own account, so each person still signs in with their own MFA, and you can see who has access.
- **Keep sign-in blocked** on the shared mailbox's account; Microsoft says it isn't meant for direct sign-in.
- Microsoft lists a maximum of **25 users** for a shared mailbox, and people outside your organization can't be given access. Use a Microsoft 365 group for those cases.

### Example: website notifications without a stored mailbox password

A common small-office need is a website form or business app that sends email. The old approach, an SMTP username and password saved in the website's settings, stops working once basic authentication is blocked, and it hands the website a full mailbox password.

This website's Request Help form takes a different route. It sends each new request to the office's shared mailbox through **Microsoft Graph**, and nothing on the website could sign in to a mailbox:

1. **A dedicated app registration** in Microsoft Entra ID, used only by the website, with **no Microsoft Graph API permissions granted in Entra ID**. In particular, there's no tenant-wide `Mail.Send`.
2. **Exchange Online RBAC for Applications** gives that app the `Application Mail.Send` role, limited by a management scope to **one shared mailbox**. The app can send as that mailbox and no one else ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac)).
3. **The website's server code** gets a short-lived token for the app and calls Graph to send the message from the shared mailbox, with the customer's address as the reply-to.
4. **The app's secret** is stored only in the hosting provider's encrypted environment settings, never in the code or a document, and must be rotated before its expiry date.
5. **Checked before going live:** Exchange's authorization test showed the app in scope for the one shared mailbox and out of scope for every other mailbox.

The scoping commands look like this (placeholders in angle brackets; run in Exchange Online PowerShell as an Exchange administrator). Record what's already there first, so you can compare and undo:

*Record the current setup first (read-only)*

```powershell
Get-ServicePrincipal | Format-List DisplayName, AppId, ObjectId
Get-ManagementScope | Format-List Name, RecipientFilter
Get-ManagementRoleAssignment -Role "Application Mail.Send" | Format-List Name, RoleAssignee, CustomResourceScope
```

*Limit an app to sending as one mailbox (changes permissions)*

```powershell
New-ManagementScope -Name "Website mailer scope" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'notifications@yourdomain.com'"
New-ServicePrincipal -AppId <application-id> -ObjectId <enterprise-app-object-id> -DisplayName "Website mailer"
New-ManagementRoleAssignment -App <enterprise-app-object-id> -Role "Application Mail.Send" -CustomResourceScope "Website mailer scope"
Test-ServicePrincipalAuthorization -Identity "Website mailer" -Resource notifications@yourdomain.com
```

> **Warning:**
> If the same app *also* has `Mail.Send` granted in Microsoft Entra ID, the scope doesn't restrict it: Microsoft adds the two grants together, so the app can send as anyone. Remove any Entra ID mail permissions from an app you scope this way. Permission changes can take 30 minutes to 2 hours to take effect. To undo the scoping, remove the role assignment, then the scope and the service principal (`Remove-ManagementRoleAssignment`, `Remove-ManagementScope`, `Remove-ServicePrincipal`); these change permissions too.

## 5. Decide how files can be shared

OneDrive and SharePoint make sharing easy, sometimes too easy. In the **SharePoint admin center → Policies → Sharing**, choose the most restrictive level that still lets you work:

- **Only people in your organization** if you never share files externally.
- **Existing guests** or **New and existing guests** if you share with clients but want them to sign in.
- **Anyone** links only if you really need them, with an **expiration** set so old links stop working.

Review external sharing once a quarter, especially after a project or staff change.

## 6. Protect devices

- **Encrypt laptops:** BitLocker on Windows, FileVault on Mac.
- **Keep Windows and Office updating automatically**, and replace devices that no longer get security updates.
- **Business Premium:** enroll company devices in **Intune** so you can require encryption and updates, and wipe company data from a lost device. Defender for Business adds endpoint detection and response.

## 7. Backups and retention

Microsoft keeps the service running and has recycle bins and restore options (OneDrive can roll back to an earlier point in time). That isn't the same as an independent backup. If an account is compromised, a file is deleted and the deletion isn't noticed in time, or someone leaves and their data is removed, recovery depends on how long those options keep data.

- Review the retention settings for mail, OneDrive, and SharePoint.
- If losing email or file history would hurt the business, add a **dedicated Microsoft 365 backup** (Microsoft offers one, and several third-party services do too).
- The [3-2-1 backup guide](https://jeremiahellington.com/resources/3-2-1-backup-guide) explains how this fits into a wider plan.

## 8. Onboarding and offboarding

Most small-office incidents start with an account that should have been closed or a password that was shared. Write these steps down and follow them every time.

**When someone joins:**

1. **Create the account and license**

   Create the user with a temporary password, assign the right plan, and add them to the groups and shared mailboxes they need, and no more.

2. **MFA on the first day**

   Have them register MFA at myprofile.microsoft.com before they start using email.

3. **Device ready**

   Encrypted, updated, and (with Business Premium) enrolled in Intune.

**When someone leaves** (do this on their last day, in this order):

1. **Block sign-in and end sessions**

   In the Microsoft 365 admin center, block sign-in for the user and sign them out of all sessions. Reset the password.

2. **Keep the mail**

   If others need the mailbox, convert it to a shared mailbox and give the right people access, or forward new mail to a manager for a set period.

3. **Move the files**

   Give a manager access to the person's OneDrive and move anything the business needs to a SharePoint site. Don't count on automatic access: when an account is deleted, Microsoft gives the manager access to its OneDrive (30 days by default to download what's needed) only if access delegation is turned on and a manager or secondary owner is set; otherwise no one gets access automatically. OneDrive cleanup starts only when the account is deleted, not when sign-in is blocked or the license is removed.

4. **Remove access everywhere else**

   Remove them from groups, shared mailboxes, and admin roles; collect company devices and wipe or reassign them; change any shared passwords they knew.

5. **Remove the license last**

   Only after mail and files are safe, remove the license and later delete the account. If an account stays in Entra ID without a license, Microsoft's [unlicensed OneDrive](https://learn.microsoft.com/en-us/sharepoint/unlicensed-onedrive-accounts) rules apply: the OneDrive becomes read-only after 60 unlicensed days and is archived after 93, and from then on neither you nor the user can open its files until you assign a license, enable billing, or reactivate it. Archived accounts incur storage charges only if billing for unlicensed OneDrive accounts has been enabled; without it, an unlicensed account is on a cumulative 365-day nonpayment clock, after which it can be deleted. A deleted account's OneDrive follows the separate deletion and retention process instead.

> **Warning:**
> Don't delete a departing user's account until their mail and files are moved. A deleted account can be [restored with its mailbox](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/restore-user) only within 30 days; after that the mailbox is gone, and the OneDrive follows its own cleanup schedule.

## 9. A small Exchange Online PowerShell toolkit

The admin centers do everything above, but PowerShell is faster for checking settings across all users. These commands use the [Exchange Online PowerShell module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2) (version 3.10 and later needs PowerShell 7.6, or use Windows PowerShell 5.1). Use **version 3.10.1 or later**: Microsoft [plans stricter sign-in requirements](https://techcommunity.microsoft.com/t5/exchange-team-blog/action-required-upgrade-exchangeonlinemanagement-powershell/ba-p/4561418) from March 31, 2027, after which older versions may fail to sign in in some interactive cases. Everything in this section only **reads** settings. The scoping example in section 4, and the undo commands listed with it, are the only commands in this guide that change anything.

*Connect and check where you are (read-only; Install-Module changes only your computer)*

```powershell
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Get-Module ExchangeOnlineManagement -ListAvailable   # check the version: 3.10.1 or later
Connect-ExchangeOnline -UserPrincipalName admin-yourname@yourdomain.com
Get-ConnectionInformation          # confirms the tenant you're connected to
```

*Mailboxes and shared mailboxes (read-only)*

```powershell
Get-EXOMailbox -ResultSize Unlimited | Select-Object DisplayName, PrimarySmtpAddress, RecipientTypeDetails
Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited
```

*Look for mail forwarding, a common sign of a compromised account (read-only)*

```powershell
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object DisplayName, ForwardingSmtpAddress, ForwardingAddress
Get-InboxRule -Mailbox someone@yourdomain.com | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }
```

*Email authentication and legacy SMTP sign-in (read-only)*

```powershell
Get-DkimSigningConfig | Format-List Name, Enabled, Status, Selector1CNAME, Selector2CNAME
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
```

*Disconnect when you're done*

```powershell
Disconnect-ExchangeOnline -Confirm:$false
```

More everyday commands are in the [PowerShell Essentials cheatsheet](https://jeremiahellington.com/resources/cheatsheets/powershell-essentials).

## Common mistakes

- **One person's everyday mailbox is the only Global Administrator.** If that person leaves or their phone is lost, nobody can manage the tenant.
- **No emergency account,** or one nobody has tested since it was created.
- **MFA for some users only.** Attackers look for the one account without it.
- **Two SPF records**, or a DMARC `reject` policy set before checking which services send as the domain.
- **Shared logins** for `info@` instead of a shared mailbox.
- **"Anyone" links that never expire.**
- **Offboarding by deleting the account** before saving the person's mail and files.
- **Assuming Microsoft's recycle bins are a backup.**

## Next steps

1. Create a separate admin account and two emergency accounts, then test them.
2. Turn on security defaults or Conditional Access, after checking for older devices that send email.
3. Publish SPF, enable DKIM, and start DMARC at `p=none`.
4. Write down your offboarding steps.
5. Work through the [Small Business Cybersecurity Checklist](https://jeremiahellington.com/resources/small-business-cybersecurity-checklist) for everything outside Microsoft 365.

---

## Sources and official documentation

- [Microsoft Learn: Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults)
- [Microsoft Learn: Mandatory multifactor authentication for admin portals](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication)
- [Microsoft Learn: Manage emergency access admin accounts](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access)
- [Microsoft Learn: Best practices for Microsoft Entra roles](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices)
- [Microsoft Learn: Why choose Microsoft 365 Business Premium?](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-security-benefits)
- [Microsoft Learn: What is Microsoft Defender for Business?](https://learn.microsoft.com/en-us/defender-business/mdb-overview)
- [Microsoft Learn: How to use DKIM for email in your custom domain](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure)
- [Microsoft Learn: Set up SPF to identify valid email sources](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure)
- [Microsoft Learn: Set up DMARC to validate the From address](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Microsoft Learn: About shared mailboxes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes)
- [Microsoft Learn: Set up a multifunction device or application to send email](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
- [Microsoft Learn: Role Based Access Control for Applications in Exchange Online](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac)
- [Microsoft Learn: About the Exchange Online PowerShell module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2)
- [Microsoft: Microsoft 365 business plans and pricing (Basic web and mobile apps; Standard and Premium add desktop apps; 'with Copilot' bundles)](https://www.microsoft.com/en-us/microsoft-365/business/microsoft-365-plans-and-pricing)
- [Microsoft Learn: Microsoft 365 Business Premium security FAQ (Entra ID P1 and Intune included)](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-security-faq)
- [Microsoft Learn: Deprecation of Basic authentication in Exchange Online (updated 2026-09-16; SMTP AUTH retirement: refer to the latest announcement)](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online)
- [Exchange Team Blog: Action Required: Upgrade ExchangeOnlineManagement PowerShell Module to Version 3.10.1 or Newer (enforcement from March 31, 2027)](https://techcommunity.microsoft.com/t5/exchange-team-blog/action-required-upgrade-exchangeonlinemanagement-powershell/ba-p/4561418)
- [Microsoft Learn: Enable or disable authenticated client SMTP submission (SMTP AUTH)](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)
- [Microsoft Learn: Restore a user in Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/restore-user)
- [Microsoft Learn: Manage unlicensed OneDrive user accounts](https://learn.microsoft.com/en-us/sharepoint/unlicensed-onedrive-accounts)
- [Microsoft Learn: OneDrive retention and deletion](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion)
- [Microsoft Learn: Remove a former employee](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee)
- [Microsoft Learn: Manage sharing settings for SharePoint and OneDrive](https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off)
- [Microsoft Learn: Overview of Microsoft 365 Backup](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-27
- Editorial review: Jeremiah Ellington, 2026-10-27