5 Microsoft 365 Security Controls Every Nonprofit Should Review

If your nonprofit runs on Microsoft 365, it may be on a granted or discounted license, and possibly without a full-time IT person. The service comes with many security settings, and which ones are available depends on your plan. These five areas are a good place to start a review. We describe them in general terms, so ask whoever manages your tenant where each one is set.

The checklist

1. Multifactor authentication. Is it required for every person, including administrators and volunteers with accounts? Shared mailboxes should be opened through each person's own account, with direct sign-in to the shared mailbox blocked. Check which sign-in methods people actually use, and whether older sign-in methods that cannot support MFA are still allowed.
2. Administrator access. Who holds administrator roles today? Keep the number small, use separate accounts for administrative work, and remove roles from people who have left or changed jobs. Board members and former contractors are easy to miss.
3. Email forwarding and mailbox rules. Does your organization allow automatic forwarding to outside addresses? Does anyone check for unexpected rules? Alerts for new forwarding rules, where your plan includes them, can help.
4. External sharing. Who can share files with people outside the organization, and with what link settings? Look for documents shared with anyone who holds the link, and for guests who no longer need access.
5. Sign-in policies and device rules. Where your license includes Conditional Access (Microsoft Entra ID P1 or higher), consider policies that block risky sign-ins or ask for a managed device. Microsoft's free nonprofit grant (Business Basic) does not include Conditional Access; it needs Microsoft Entra ID P1, which comes with Business Premium. Microsoft's nonprofit offers change, so check what your plan includes today. Security defaults offer a baseline for organizations without those policies.

How to use it

For each area, note whether you know the answer, whether the setting is where you want it, and who is responsible for it. A "we do not know" is a useful finding, not a failure.

Some of these controls may depend on your license. Confirm what your plan includes before planning a change, and do not turn things on without testing, because some settings can lock people out of their accounts.

Take the next step

Our free Microsoft 365 security assessment asks five quick questions about sign-in, email, sharing, devices and backup, and shows where a nonprofit like yours can start. It is a short check, not a full review of your settings.

Related reading

• 5 Microsoft 365 Settings Attackers Hope You Have Not Reviewed
• Why MFA Alone Does Not Equal Zero Trust
• Is Microsoft 365 Secure Out of the Box?