Microsoft 365 for a small organisation: ten things to get right in the first week

Microsoft 365 is easy to start and awkward to tidy later. A few decisions made in the first week save a great deal of cleaning up once there are dozens of mailboxes, shared files and accounts. These are the ten we check first. Menus and plan names change from time to time, so treat this as a list of things to verify rather than exact steps.

1. Use separate administrator accounts

Do not give an everyday mailbox administrator rights. Keep one or two dedicated admin accounts that are used only for administration, with strong unique passwords and multi-factor sign-in. Keep an emergency account stored safely offline in case something locks everyone out.

2. Require multi-factor sign-in for everyone

A stolen password should not be enough. Turn on multi-factor authentication for all users, starting with administrators. Depending on your licence this is done through the default security settings or through policies you create yourself.

3. Block old sign-in methods

Older mail protocols cannot ask for a second factor, so attackers use them to bypass it. Check that legacy authentication is blocked unless you have a specific, documented reason to allow it.

4. Set up your domain's email authentication

Publish SPF, DKIM and DMARC records for your domain. They tell other mail servers which senders are genuine, they help your own messages reach inboxes, and they make it harder for someone to send email pretending to be you.

5. Use shared mailboxes, not shared passwords

Addresses such as info@ or support@ should be shared mailboxes that named people are given access to. Nobody should know a password that several people use, and when a person leaves you simply remove their access.

6. Name things consistently

Agree a simple pattern for groups, Teams and SharePoint sites before they multiply, and give each an owner. Unowned groups and sites are where information gets lost and access is forgotten.

7. Decide who can share files outside the organisation

Check the external sharing settings for SharePoint and OneDrive. The right setting depends on your business, but it should be a decision, not a default. Prefer links to specific people over links that anyone can open, and review what has been shared externally from time to time.

8. Understand retention, and do not treat it as backup

Deleted items are kept for a limited time, and there are recovery limits. That protects against some mistakes, not against everything. Read the retention settings for your plan and decide whether you need a separate backup of mailboxes and files.

9. Write a joiners-and-leavers procedure

For a new person: create the account, give the correct licence and group memberships, and enable multi-factor sign-in. For a leaver: block sign-in, reset the password, end active sessions, deal with the mailbox and files, and remove the licence only when the data has been handled. Using the same checklist every time is what keeps old accounts from lingering.

10. Switch on auditing and read it

Make sure activity logging is enabled, and know where to look when you need to answer "who deleted this?" or "who signed in from where?". Turn on alerts for the events that matter most, such as new forwarding rules and sign-ins from unexpected places.

Write it down

Keep a short document: the admin accounts and who holds them, the policies you chose and why, and the leaver checklist. In a small organisation that document is often the difference between a ten-minute fix and a lost afternoon.