Securing Microsoft 365 for a 50‑Person Company: The First 30 Days

Start with the answer: in a 50‑person company you can raise Microsoft 365 security a lot in 30 days if you work in order. Protect the administrator accounts first, enforce MFA and block legacy sign-in second, harden email third, manage devices and sharing fourth, and finish with logging, alerting and a recovery check. CISA's SCuBA project publishes secure configuration baselines for Microsoft 365 that give you a reviewed, vendor-neutral checklist. They were written for federal agencies, so treat them as a strong starting point and adapt them to your size.

What SCuBA gives you

SCuBA stands for Secure Cloud Business Applications. CISA publishes baseline documents for Microsoft 365 services such as Entra ID, Exchange Online, Defender, SharePoint, OneDrive and Teams, along with an open assessment tool that compares a tenant with the baseline. Some items are required and some are recommended. A small company will not adopt every line, but each line you skip should be a decision with a name and a date, not an accident.

Days 1 to 7: identity and visibility

• Count administrators. Most small tenants have too many. Reduce them, give each admin a separate account for admin work and remove the admin role from daily accounts.
• Create two emergency access accounts with long unique passwords stored offline, excluded from normal policies and monitored by alert.
• Enforce MFA for all admins today, then for everyone. Prefer security keys or passkeys for admins.
• Block legacy authentication, which cannot do MFA.
• Turn on audit logging and confirm you can search it. Do this first so you have a record from day one.
• Review sign-ins from the last 30 days for odd countries and for any inbox rules that forward mail outside the company.

Days 8 to 14: email

Email is where most incidents start. Check that your domain publishes SPF, DKIM and DMARC records and move DMARC from monitoring to enforcement once reports look clean. Turn on anti-phishing and safe attachment and link protections in your plan. Block automatic external forwarding, and alert when new forwarding or inbox rules are created. Label external mail so staff can see it. Write one short instruction for staff on how to report a suspicious message.

Days 15 to 21: devices, apps and sharing

• Decide which devices may reach company data. Require a managed or compliant device for mail and files where your licensing allows.
• Enable disk encryption and screen lock on laptops, and keep operating systems and browsers updating automatically.
• Limit user consent to third-party apps so staff cannot grant broad access to unknown apps.
• Review external sharing in SharePoint, OneDrive and Teams. Set defaults to the narrowest that still lets the business work, and review existing anonymous links.
• Remove accounts for people who have left and shared mailboxes nobody uses.

Days 22 to 30: detection, recovery and proof

Set alerts for the events that matter: new admin role assignments, new MFA methods, impossible travel, mass file downloads and new forwarding rules. Decide who receives them and what they do at night and on weekends. Microsoft 365 retention is not a backup, so confirm what you can recover and for how long, and consider an independent backup of mail and files. Run the SCuBA assessment tool against the tenant, record each gap and set owners and dates. Finally, hold a one-hour exercise: a user reports a phishing link they clicked. Who revokes sessions, resets the password and checks the mailbox?

What to expect

Thirty days will not make a tenant perfect, but it removes the common ways in: weak admin accounts, missing MFA, spoofable mail, unmanaged devices and no logs. Plan time for user communication, because MFA and device rules change daily habits. Pilot with a few users first, then roll out company-wide.

Where we help

Our cybersecurity team and our Microsoft 365 experience cover this plan end to end: tenant review against the baselines, rollout, staff messaging and monitoring. Licensing affects which controls are available, so we start by checking what your plan already includes. See our Cybersecurity service to begin.

Sources

• CISA, Secure Cloud Business Applications (SCuBA) Project
• CISA, More than a Password (multi-factor authentication)
• CISA, Cyber Guidance for Small Businesses

This article is general information, not legal advice. Standards and vendor documentation change; confirm current requirements with your regulator, counsel and IT provider. Last reviewed November 9, 2026.

Keep reading

Next · SecurityWhat a Security Operations Center Actually Does OvernightA security operations center watches your systems around the clock, sorts real threats from noise, and wakes the right person with a clear recommendation. Most of the night is triage, not drama.6 min read

• What a Code and Endpoint Security Review Finds in the First 24 Hours7 min
• Before Anyone Scans Your Website: Verification and Written Authorization7 min