If you have Microsoft 365 Business Premium, you already own the tools to be genuinely well secured. This is the checklist we work through when we harden a small firm's tenant, written so you can run down it yourself. Nothing here needs a licence beyond Business Premium. Print it, tick it off, and you will have closed the gaps that matter.
Identity and sign in
- MFA enforced for every user, no exceptions, through Conditional Access rather than just Security Defaults
- Legacy authentication blocked
- A break glass admin account, cloud only, excluded from policies, password held offline
- Admin roles kept to the few who need them, not handed out by default
- Sign in risk and user risk policies on where your licence allows
Devices
- Every Windows laptop enrolled in Intune
- BitLocker enforced and recovery keys escrowed to Entra
- A compliance policy that actually blocks non compliant devices through Conditional Access
- Updates managed, whether by Autopatch or update rings someone minds
- Defender for Business deployed and reporting, not just licensed
Email and data
- Anti phishing and anti spoofing (SPF, DKIM, DMARC) set up on your domain
- Safe Links and Safe Attachments on
- External sharing on SharePoint and OneDrive set to what you actually need, not wide open
- A retention and deletion policy that matches how long you should keep things
People and process
- A joiner process so new staff get the right access and nothing more
- A leaver process that shuts access off the same day, every time
- Licences reviewed so you are not paying for seats nobody uses
- Someone, internal or external, who owns checking all of the above stays true
Work down this list and your Business Premium is doing the job you pay for. If you want it done for you and kept that way, that is a Hardening project and Managed Intune.