Serving Vancouver, Washington and remote U.S. businesses

Call Text

Microsoft 365 Resource

Microsoft 365 Security Checklist for Small Businesses

Use this checklist to review the Microsoft 365 settings that most small businesses depend on every day. It is designed for business owners and office managers who need a practical way to reduce account, email, and access risk.

View the checklist Request help
Start here

Why this matters

Microsoft 365 often grows quickly. Employees are added, licenses change, shared mailboxes appear, and administrator access can become unclear. A basic security review helps confirm that the right people have the right access.

Use this resource when

  • You are not sure who has administrator access.
  • Employees use Microsoft 365 for email, files, and Teams.
  • Multi-Factor Authentication is not fully enforced.
  • You want a basic security review before something breaks.

What to review

  • Confirm every active user account belongs to a current employee or approved vendor.
  • Review global administrator and privileged administrator roles.
  • Turn on Multi-Factor Authentication (MFA) for every account.
  • Review shared mailboxes, distribution lists, and external forwarding.
  • Check license assignments and remove unused licenses.
  • Review sign-in activity for unusual locations or inactive accounts.
Step by step

Practical checklist

  1. Export or review your active user list.
  2. Mark each user as current employee, vendor, shared account, or former employee.
  3. Review administrator roles and remove access that is no longer needed.
  4. Confirm Multi-Factor Authentication (MFA) is enabled and working.
  5. Review shared mailboxes and external forwarding rules.
  6. Document anything that needs cleanup and assign an owner.
Avoid these issues

Common mistakes

  • Leaving old employee accounts active.
  • Giving too many people administrator access.
  • Using shared accounts instead of named accounts.
  • Forgetting to review mailbox forwarding.
  • Keeping unused licenses because no one checks them.

Need help turning this into a working process?

J3 Systems Group can review Microsoft 365 accounts, administrator roles, Multi-Factor Authentication, license usage, and basic security settings for small businesses.

Schedule a consultation

Related resources