Microsoft 365 security checklist for small businesses in Dubai and the UAE

This Microsoft 365 security checklist covers seven areas a small business in Dubai or elsewhere in the UAE can work through in order to secure most of its tenant: confirm security defaults or Conditional Access requires multifactor sign in for everyone, lock down admin accounts, apply Microsoft’s preset email protection and stop automatic forwarding to outside addresses, restrict external file sharing, manage the devices that reach company data, switch on audit logging, and use Secure Score to track what is left. Almost all of it is configuration inside licences you already pay for.

The checklist below follows Microsoft’s own documentation for business plans, which Microsoft aims at organisations with up to 300 users, and notes where a setting depends on Business Premium. Microsoft changes defaults from time to time, so each item reflects the documentation as of September 2026.

Microsoft 365 security checklist: know your plan first

Microsoft’s security best practices article for business plans compares Basic, Standard and Premium. The difference matters because several items on this checklist only exist in Premium.

Before changing anything, open the Microsoft 365 admin center, list which licences each user holds, and note who has an admin role. That list is the baseline for everything below, and it is the kind of record our IT support team keeps up to date for clients.

Sign in: security defaults or Conditional Access

This Microsoft 365 security checklist starts sign in here. Microsoft Entra security defaults are a single switch that applies a fixed set of protections. Microsoft’s documentation lists them as requiring every user to register for multifactor authentication, requiring admins to complete it, prompting other users when Microsoft judges it necessary, blocking legacy authentication protocols, blocking device code flow and requiring multifactor authentication for Azure management tools. Microsoft says security defaults are rolled out to new tenants when they are created.

• Check the switch. In the Microsoft Entra admin center, go to Entra ID, Overview, Properties, then Manage security defaults. If you do not use Conditional Access, it should be enabled.
• Check for old devices and apps. Legacy authentication covers clients that do not use modern authentication and older mail protocols such as IMAP, SMTP and POP3. Microsoft warns that these cannot use multifactor authentication and are blocked once defaults are on, so find scanners, line of business apps and old mail clients first.
• Know what changed in 2024 and 2026. Microsoft removed the 14 day grace period for registering multifactor authentication from 29 July 2024. From 1 July 2026, new tenants block device code flow as part of security defaults.
• Revoke existing sessions. When enabling defaults on an established tenant, Microsoft advises revoking active tokens so users already signed in have to register.

If you have Business Premium and need exceptions, such as allowing sign in only from managed devices, Conditional Access replaces security defaults. Microsoft’s instruction is that security defaults must be disabled when Conditional Access policies take over, and that equivalent policies should be enabled immediately afterwards so there is no gap.

Microsoft 365 security checklist: admin accounts, fewer and protected

The next item on this Microsoft 365 security checklist is admin accounts. Whoever signed up for Microsoft 365 became a Global Administrator. In many small UAE companies that person is the founder, an office manager or a supplier who set things up years ago, and the same account is used for daily email. Microsoft’s guidance on admin accounts for business plans recommends a different arrangement.

1. Two emergency access accounts. Not assigned to a specific person, used only in emergencies, excluded from multifactor requirements and therefore protected by long, complex passwords of 16 or more characters stored securely.
2. Least privilege for everyone else. Someone who only creates users should hold the User Administrator role, not Global Administrator. Microsoft warns that too many admin accounts give attackers more opportunities.
3. Separate daily and admin identities. Admins sign in to email and documents with an ordinary account and use the admin account only when needed, in a private browser window, signing out afterwards. Admin only accounts do not need a licence.
4. Names that do not advertise privilege. Avoid labels such as “admin” in the account name.
5. Passwordless sign in for admins using the Authenticator app, passkeys or Windows Hello for Business, which Microsoft lists as available even on Basic and Standard.

If a supplier holds your only Global Administrator account, you do not fully control your own tenant.

Email: preset policies and outside forwarding

Email is the third item on this Microsoft 365 security checklist. Every cloud mailbox gets built in protection against spam, malware and spoofing. Microsoft’s preset security policies apply its recommended settings in one step instead of tuning dozens of options by hand. There are Standard and Strict presets, plus a Built-in protection preset that gives basic Safe Links and Safe Attachments coverage in tenants with Defender for Office 365. You find them in the Microsoft Defender portal under Email and collaboration, Policies and rules, Threat policies.

The second email setting deserves particular attention. A common problem we see in UAE companies is payment fraud that starts with a mailbox someone else has quietly taken over, and Microsoft notes that inbox rules forwarding mail to outside recipients can be created as a result of a compromised account. Microsoft’s outbound spam policy has three choices for automatic external forwarding: Automatic, System controlled; On; and Off. Microsoft explains that the automatic setting behaves differently depending on when and how the tenant was set up, and recommends choosing On or Off explicitly.

• Set automatic external forwarding to Off in the default outbound spam policy.
• If a team genuinely needs to forward to a partner, allow it only for that domain through remote domain settings.
• Review the Auto forwarded messages report monthly for users who are forwarding outside the company.
• Confirm SPF, DKIM and DMARC are in place for your domain, as described on our cyber security page.

Files and sharing in SharePoint and OneDrive

Sharing is the fourth item on this Microsoft 365 security checklist. SharePoint and OneDrive offer four organisation level sharing levels: Anyone, New and existing guests, Existing guests, and Only people in your organisation. The OneDrive setting can be stricter than SharePoint but never more open, and each site can be stricter than the organisation.

• Choose New and existing guests unless there is a clear need for links that work without signing in.
• If Anyone links are allowed, make them expire and limit them to view only.
• Set the default link type to Specific people or Only people in your organisation.
• Set guest access to expire automatically after a period that suits your projects.
• Where external sharing is only needed with known partners, limit it by domain.

Microsoft notes that if external sharing is restricted, guests typically lose access within an hour, so warn project teams before changing the setting. For where company data should live in the first place, see our cloud services.

Devices that reach company data

Devices are the fifth item on this Microsoft 365 security checklist. Staff in Dubai offices often read company email on personal phones. Every business plan includes Basic Mobility and Security, a free subset of Intune that can require a device password before company apps open, and can remove company data from a device or reset it to factory settings. Business Premium adds Microsoft Intune Plan 1 for managing both devices and apps, and device protection policies with Microsoft Defender for Business for laptops and desktops.

• Require a device password on any phone that syncs company email.
• Know who can remove company data from a lost or stolen device, and test the process once.
• On Business Premium, enrol company laptops in Intune and turn on Defender for Business protection.
• Keep a register of which device belongs to which person, and update it when people leave.

Microsoft 365 security checklist: audit logging and Secure Score

Audit logging is the item most small tenants miss on this Microsoft 365 security checklist. Microsoft’s Purview documentation says audit logging is on by default for Microsoft 365 organisations in general, but not for small and medium business licences including Business Basic, Standard and Premium, which must turn it on manually. Once enabled, the audit log records user and admin activity and retains it for 180 days by default. Without it, there may be little record to show what an attacker did after taking over a mailbox.

To turn it on, open the Microsoft Purview portal, select the Audit solution, and choose the banner to start recording user and admin activity. Microsoft says this can take up to 60 minutes to take effect.

Microsoft Secure Score, at security.microsoft.com/securescore, then gives you a running list of recommended actions. Each action is worth up to ten points, and some award partial points, such as protecting half your users. Turning on security defaults earns full points for the multifactor and legacy authentication recommendations. Microsoft is careful to say that Secure Score reflects how far you use recommended controls, not an absolute measure of whether you could be breached, and that security has to be balanced with usability. Review it monthly and record any recommendation you decide not to follow, with the reason.

The UAE context: official guidance and where to report

The UAE Cyber Security Council publishes guidance for businesses that lines up with this Microsoft 365 security checklist. It advises companies to review threat updates regularly, prepare and test response plans for suspicious activity, train staff regularly, audit systems periodically for vulnerabilities, and work with cyber security professionals to assess their defences.

For reporting, the Council’s website points Dubai users to the Dubai Police eCrime website, Abu Dhabi users to the Aman service, and everyone to the Ministry of Interior’s eCrimes platform, the nearest police station or 999. If a compromised account exposed customer information, your obligations under UAE data protection law are a question for a legal adviser; our article on email marketing consent under the UAE data protection law introduces that law in a marketing context. This section is general information, not legal advice.

How Digital Marketing Dubai can help

We review a tenant against this Microsoft 365 security checklist, make the changes with you, and document every setting in a register you keep. The work is part of our IT services, with day to day administration through IT support and email authentication and staff awareness through cyber security. We are not a security operations centre, we do not hold security certifications, and no configuration can promise that an attack will never succeed. What you get is a tenant set up the way Microsoft documents it, and a written fixed price proposal within 45 minutes during business hours.