Microsoft 365 Business Setup Checklist for Small Businesses

Phase 1: Domain and DNS

Everything in Microsoft 365 hangs off your verified domain, so get this right before creating a single mailbox.

1. Add and verify your custom domain in the Microsoft 365 admin centre.
2. Set the custom domain, not the onmicrosoft.com domain, as the default for new users.
3. Update MX records to point mail flow at Exchange Online.
4. Add the Autodiscover CNAME so Outlook and mobile mail clients configure automatically.
5. Keep the onmicrosoft.com domain as a backup reference, never delete it.

Phase 2: Identity and groups

Identity is the security perimeter in a cloud-first business, more so than any firewall. Build the structure before you add users, not after. See our guide on Microsoft 365 security best practices for the reasoning behind identity-first design.

• Create a naming convention for usernames and display names before onboarding staff
• Build Microsoft 365 groups or security groups that mirror departments, not the org chart from three reorgs ago
• Set up dynamic groups where membership should follow attributes such as department or location
• Assign no more than two or three Global Administrator accounts, each dedicated to admin tasks only

Phase 3: MFA and conditional access basics

Multi-factor authentication is non-negotiable in 2026, and Conditional Access is what turns MFA from a blunt instrument into a policy engine. Read how MFA protects your business for the underlying threat model.

• Require MFA for every licensed user, with no standing exceptions for executives
• Use the Microsoft Authenticator app with number matching rather than SMS where possible
• Block legacy authentication protocols tenant-wide
• Require MFA for all admin role sign-ins regardless of location
• Build a baseline Conditional Access policy requiring compliant or hybrid-joined devices for access to SharePoint and Exchange

Phase 4: Licence assignment

Licence sprawl starts on day one when everyone gets the same SKU regardless of role. Assign deliberately, and revisit quarterly. Our Microsoft 365 Business Premium comparison explains what each tier actually includes.

• Match licence tier to role, not habit: front-line staff rarely need the same SKU as management
• Use group-based licensing so new starters inherit the correct licence automatically
• Track unused and dormant licences monthly

Phase 5: Exchange Online settings

• Set a sensible default mailbox retention and litigation hold policy where required
• Enable mailbox audit logging tenant-wide
• Configure shared mailboxes for departmental inboxes instead of shared logins
• Set external sender warnings so staff can spot impersonation at a glance
• Disable auto-forwarding to external domains by default

Phase 6: Email authentication (SPF, DKIM, DMARC)

Without these three DNS records, anyone can forge an email that appears to come from your domain. This is foundational for the anti-phishing work covered in securing business email from phishing.

1. Publish an SPF record listing Microsoft 365 and any other legitimate senders (marketing tools, invoicing platforms).
2. Enable DKIM signing for your domain in the Microsoft 365 admin centre.
3. Publish a DMARC record starting at p=none to monitor without blocking.
4. Review DMARC reports for two to four weeks, then move to p=quarantine.
5. Move to p=reject once you're confident all legitimate senders are authenticated.

Phase 7: SharePoint and OneDrive structure

Set the structure before anyone starts saving files, because migrating a messy structure later is far more disruptive than building it correctly up front.

• Create a SharePoint site per department or project, not one giant document library
• Restrict external sharing to authenticated guests by default, not anyone-with-the-link
• Set OneDrive as the default for personal working files, with SharePoint for shared and departmental documents
• Apply sensitivity labels to documents containing financial, HR, or client data

Phase 8: Teams governance

• Decide who can create new Teams, rather than leaving it open to everyone
• Set a naming convention and an expiration policy for project-based Teams
• Archive or delete Teams that have gone dormant instead of letting them accumulate
• Control guest access at the tenant level before enabling it broadly

Phase 9: Device enrolment

Every device that touches company data should be enrolled and managed, whether company-owned or personal. See why modern businesses need endpoint management for the full case, and consider mobile device management for phones and tablets.

• Enrol Windows devices in Intune via automatic enrolment or Autopilot
• Enforce disk encryption, screen lock, and minimum OS version compliance
• Set app protection policies for personal phones accessing company email
• Build a compliance policy that feeds into Conditional Access device checks

Phase 10: Retention and backup

Retention policies and backup solve different problems and both are required. Retention governs how long data is kept for compliance; backup protects against deletion, corruption, and ransomware. Native Microsoft 365 retention is not a backup, a point we cover in depth in why Microsoft 365 backup is necessary.

• Set retention policies for Exchange, SharePoint, and Teams based on your compliance obligations
• Deploy a dedicated third-party SaaS backup solution covering Exchange, OneDrive, SharePoint, and Teams
• Test a restore at least once after initial setup to confirm the backup actually works

Phase 11: Offboarding process

A documented offboarding process closes the single most common security gap we find in growing businesses: former employees who still have active access.

1. Disable the account sign-in immediately upon departure, before removing licences.
2. Convert the mailbox to a shared mailbox if ongoing access to correspondence is needed.
3. Revoke all active sessions and refresh tokens.
4. Transfer OneDrive file ownership to a manager or successor.
5. Remove the user from all groups, Teams, and distribution lists.
6. Reclaim the licence and reassign or retire it.
7. Document the offboarding date and actions taken for audit purposes.

Setup checklist at a glance

Sources and further reading

• Microsoft Learn: Microsoft 365 setup guides
• Canadian Centre for Cyber Security: baseline cyber security controls

Frequently asked questions