Microsoft 365 guide
Business Basic Security: What's Included and What to Switch On
Short answer
Business Basic includes more security than most businesses switch on: multi-factor sign-in through security defaults, Microsoft's standard anti-spam, anti-malware and anti-phishing filtering, and Basic Mobility and Security for simple phone management. It doesn't include Intune, Conditional Access, Defender for Office 365 (Safe Links and Safe Attachments) or data loss prevention. Those come with Business Premium or as add-ons.
What Business Basic includes
| Protection | Business Basic | Business Premium |
|---|---|---|
| Multi-factor sign-in (security defaults) | Yes | Yes |
| Conditional Access rules | No | Yes |
| Anti-spam, anti-malware and anti-phishing for email | Yes | Yes |
| Safe Links and Safe Attachments (Defender for Office 365 Plan 1) | No | Yes |
| Basic Mobility and Security (simple phone management) | Yes | Yes |
| Intune device and app management | No | Yes |
| Defender for Business (antivirus with detection and response) | No | Yes |
| Message encryption, data loss prevention, sensitivity labels | No | Yes |
The table follows Microsoft's own security best-practices page for the Business plans. The rest of this guide is about getting the Business Basic column working, because most of it doesn't help until someone sets it up.
1. Check security defaults are on
Security defaults are the free bundle that makes everyone use multi-factor sign-in and blocks old sign-in methods that skip it. They're on for tenants created since 22 October 2019, but older tenants may not have them.
- Sign in to the Microsoft Entra admin centre.
- Go to Entra ID > Overview > Properties and select Manage security defaults.
- Set it to Enabled and save.
Two things to know before you switch it on. People must register the Microsoft Authenticator app straight away: Microsoft removed the old 14-day grace period in July 2024. And older devices or apps that sign in with just a username and password stop working. The usual casualty is an office scanner that emails scans; Microsoft publishes the supported ways to set those up.
2. Get everyone registered
Send each person to myprofile.microsoft.com, then Security info, to add the Authenticator app. When they sign in somewhere new they'll be asked to type a number shown on screen into the app, which stops someone approving a request they didn't make.
3. Protect the admin accounts
Microsoft's advice is to keep admin accounts separate from day-to-day email, so the account that can change everything isn't the one opening invoices. For a small business the practical version is: have two Global admins, so one lost phone doesn't lock you out, and no more than you need. Microsoft goes further and recommends two cloud-only emergency accounts kept just for lock-outs.
4. Apply the Standard preset email policy
Basic includes Exchange Online Protection, Microsoft's spam, malware and phishing filter. Microsoft's preset policies turn its settings up to a recommended level in one go.
In the Microsoft Defender portal go to Email & collaboration > Policies & rules > Threat policies > Preset security policies, and turn on Standard protection for everyone.
5. Make sure external auto-forwarding is blocked
A common sign of a hacked mailbox is a hidden rule forwarding everything to an outside address. Microsoft blocks automatic external forwarding by default, but it's worth checking nobody has turned it back on.
In the Defender portal, open Threat policies > Anti-spam and select Anti-spam outbound policy (Default). Automatic forwarding rules should be Automatic - System-controlled or Off. If one person genuinely needs forwarding, create a separate policy just for them.
6. Set up DKIM and DMARC
SPF, DKIM and DMARC prove to other mail servers that email from your domain really came from you. They stop people spoofing your address to your customers and help your own mail reach inboxes. DKIM is switched on in the Defender portal under Threat policies > Email authentication settings. Our SPF, DKIM and DMARC guide covers the DNS side.
7. Tag email from outside the business
An "External" label on mail from outside your business makes a fake "message from the boss" much easier to spot. It's one command in Exchange Online PowerShell:
Connect-ExchangeOnline
Set-ExternalInOutlook -Enabled $trueThe tag shows in Outlook on the web, the Outlook phone app and the new Outlook.
8. Turn on Basic Mobility and Security for phones
Basic Mobility and Security is a cut-down version of Intune that comes with every Business plan. It can require a passcode on phones that read company email and wipe company data from a lost one.
- Open the Basic Mobility and Security page and select Enable feature on the Overview tab. Reload after a few minutes.
- If people sign in with your own domain, add the two DNS records (CNAMEs) Microsoft lists in its setup guide.
- For iPhones, create the Apple MDM push certificate from the same page. It lasts a year and has to be renewed every year, so put a reminder in the calendar.
- On the Organization Setting tab, Microsoft recommends setting unsupported devices to Block access.
- Create a device policy (passcode, encryption) and apply it to everyone.
Microsoft's own caveat: it won't prompt Windows PCs to enrol when people open Outlook, which needs Entra ID P1. It's a phone tool.
9. Tighten file sharing
New Microsoft 365 tenants allow "Anyone" links, which work for whoever has the link, with no sign-in. If you don't need them, in the SharePoint admin centre go to Policies > Sharing and set SharePoint and OneDrive to New and existing guests, so outside people have to sign in. Set the default link type to Specific people while you're there.
10. Check Secure Score and the audit log
Microsoft Secure Score lists improvement actions for your tenant and tracks them over time. Some actions need Premium features; mark those as not applicable rather than chasing them. Check it monthly.
Also check the audit log is recording, under Audit in the Microsoft Purview portal. If an account is ever compromised, it's the record of what happened. Audit (Standard) keeps records for 180 days.
When Business Basic isn't enough
Basic can't decide which devices may open company data, can't scan links at the moment they're clicked, and can't manage antivirus on laptops. If staff read work email on their own phones, laptops leave the office, or a customer or insurer is asking security questions, look at:
- Add-ons to Basic: Defender for Office 365 Plan 1, Entra ID P1 (for Conditional Access), Intune Plan 1 and Defender for Business are all sold separately.
- Business Premium, which bundles all of them with the desktop Office apps. Once you need two or three add-ons it's usually simpler, and we'll compare the two for your headcount.
Want this checklist done for you?
We'll switch these on, register your team's phones and leave you with a short note of what was changed.
Ask us to secure your accountQuestions
Does Microsoft 365 Business Basic include MFA?
Yes. Security defaults, included with every Business plan, make everyone register for multi-factor sign-in with the Microsoft Authenticator app and block older sign-in methods that skip it.
Does Business Basic include Intune?
No. It includes Basic Mobility and Security, which Microsoft describes as a limited subset of Intune for managing phones. Full Intune comes with Business Premium or as the Intune Plan 1 add-on.
Does Business Basic include Microsoft Defender?
It includes Exchange Online Protection, Microsoft's standard spam, malware and phishing filter. Defender for Office 365 (Safe Links and Safe Attachments) and Defender for Business (device protection) are in Business Premium or sold as add-ons.
Can I use Conditional Access on Business Basic?
Not on its own. Conditional Access needs Microsoft Entra ID P1, which you can add to Business Basic or get with Business Premium. Security defaults and Conditional Access can't be used together.
Is Business Basic enough for Cyber Essentials?
It can cover the cloud-service parts, especially multi-factor sign-in. Cyber Essentials also covers your devices (malware protection, updates and firewalls), which Business Basic doesn't manage, so those need handling separately.
Why did my scanner stop emailing after turning on security defaults?
Security defaults block legacy sign-in, which many older scanners use to send email. Microsoft documents supported alternatives for multifunction devices, such as sending through a connector instead.
Related guides
Sources
- Microsoft 365 for business security best practices
- Configure security defaults for Microsoft Entra ID
- Set up Basic Mobility and Security
- Overview of Basic Mobility and Security
- How to set up a multifunction device or application to send email using Microsoft 365
We checked every limit, menu path and date in this guide against the sources above on 9 October 2026. Microsoft changes these often. If something here no longer matches what you see, tell us and we'll update it.