Microsoft 365
The Microsoft 365 Security Checklist Every NZ Business Should Run
1. Turn on multi-factor authentication for everyone
MFA is the single highest-impact control available. If you only do one thing on this list, do this. Conditional access policies in Entra ID make MFA the rule rather than the exception - and block sign-ins from locations and devices that do not fit your business.
2. Review who can reset passwords and access admin
Global Administrator is the keys to the kingdom, and tenants accumulate far too many of them. Reduce admin roles to the few people who genuinely need them, and use Privileged Identity Management to grant access only when needed.
3. Check your mail flow and anti-phishing rules
Most successful attacks enter by email. Review your anti-phishing and anti-spam settings, enable safe links and attachments in Defender for Office 365, and add external-warning banners so staff pause before clicking.
4. Enable audit logging
You cannot investigate what you cannot see. Audit logging records who did what across the tenant and is essential for incident response - and for answering 'what happened?' when something goes wrong.
5. Back up Microsoft 365
As covered in our backup article, Microsoft does not back up your tenant on your behalf. Deleted mailboxes, ransomware and ex-employees are your problem without proper backup.
6. Review stale accounts and external sharing
Departing staff accounts that still work are a standing invitation. Regularly review inactive accounts and external sharing links, and require approval for sensitive sharing.
7. Patch and manage devices with Intune
Unmanaged devices are the weak point of any tenant. Intune enforces updates, compliance and configuration - and gives you the visibility to know what is actually connected.
Quick answers
No control is enough alone, but MFA stops the majority of account-takeover attacks we see. It is the foundation, not the whole wall.
Yes - a tenant health check is the starting point of our Microsoft 365 support service.
Need help putting this into practice?
The Click IT team is based in Tauranga and helps businesses across New Zealand act on advice like this.
Last updated: 2026-06-10. This article is general information, not specific advice for your situation - talk to us about your circumstances.