Microsoft 365 Security Checklist for SMBs

A de facto standard for cyber insurers and prime contractors

By 2026, Microsoft Secure Score has become the go-to indicator for measuring the cybersecurity posture of any Microsoft 365 organization. Canadian cyber insurers (Beazley, Chubb, Intact, AIG) ask for it at renewal. A growing number of public-sector and large private-sector buyers require it in their due-diligence questionnaires. The Commission d'accès à l'information (CAI) may refer to it during a Law 25 compliance audit.

A score of 40/100 - typical of an SMB that has never hardened its tenant - is a red flag. A score of 80+ reflects a defensible posture. This white paper gives you the method to get from one to the other in 30 days.

The cost of doing nothing

The average cost of a ransomware incident for a North American SMB in 2024-2025 runs between $280,000 and $1.2M all in (downtime, any ransom paid, restoration, legal fees, cyber insurance premium). On top of that come Law 25 penalties of up to $10M or 2% of worldwide revenue (in force since Sept. 2023), and direct private civil action (s. 93.1) with punitive damages of at least $1,000 per affected individual.

For a Quebec SMB, a poorly handled incident can be an existential threat. The good news: most of the settings covered here are free (included in Microsoft 365 Business Premium or E3/E5 licences).

Administrative prerequisites

Before you change anything, three preparations are non-negotiable - skip them and you risk major operational incidents:

• Set up a "hardening" pair: an executive sponsor plus an IT operator. Without a sponsor, user friction will force you to back down.
• Communicate internally 7 days before each wave (MFA, legacy auth block, Defender). A clear email plus a simple FAQ is enough.
• Create 2 "break-glass" admin accounts excluded from every Conditional Access policy, with strong passwords stored in a physical safe. Essential in the event of a tenant-wide lockout.

The validation cycle

For every critical policy (MFA, Conditional Access, Defender), we follow a 4-step cycle: impact analysis (Microsoft Entra → What If), a 5-day pilot with 10 to 20 volunteer users, gradual rollout in waves of 25%, then full deployment. This sequencing catches broken service accounts and integrations before they hit everyone.