Microsoft 365 Security Checklist for Not-for-Profits

For many not-for-profits, Microsoft 365 is where the real day-to-day risk sits. Client information moves through Outlook, Teams, SharePoint, OneDrive, Excel, PDFs, forms, and staff devices long before it ever reaches a formal system or policy document. That is why a basic cyber conversation is often incomplete unless it includes a practical Microsoft 365 review.

If your organisation needs a structured starting point, the NFP Technology Health Check NSW is designed to review Microsoft 365, cyber controls, staff AI use, client-data handling, and reporting risk together.

Why Microsoft 365 security matters for smaller not-for-profits

Smaller NSW not-for-profits often depend on Microsoft 365 more heavily than they realise. It becomes the operating layer for board packs, funding evidence, HR conversations, case notes, spreadsheets, referral forms, shared folders, and contractor collaboration. The platform is powerful, but it is also easy for permissions, sharing, and admin practices to drift over time.

The main risk is not usually one dramatic failure. It is the accumulation of small gaps:

• too many global admins
• weak MFA practices
• staff forwarding mail externally
• SharePoint folders shared far too broadly
• old accounts still active
• sensitive files copied into personal devices
• no clear evidence of what is being monitored or reviewed

That combination is exactly why boards and CEOs start asking whether Microsoft 365 is actually secure or only assumed to be secure.

Microsoft 365 security checklist for not-for-profits

Use this list as a practical baseline.

1. MFA is enforced for every staff member, board member, contractor, and admin account. No exceptions for convenience.
2. Admin accounts are separated from normal user accounts. Everyday email should not be done from privileged identities.
3. There are only a small number of global admins. If many people have admin rights, the environment is harder to control.
4. External sharing is restricted and reviewed. Teams, SharePoint, and OneDrive links should not be left open by default.
5. User access is removed promptly for leavers. Offboarding delays create avoidable exposure.
6. Mail forwarding rules are monitored. Hidden forwarding to personal or unknown addresses is a common risk.
7. Board, HR, and client files are segmented. Sensitive information should not sit in general-purpose folders that broad groups can access.
8. Conditional access or equivalent controls exist for higher-risk access. Geography, device status, and admin logins should not all be treated the same.
9. Backup and recovery expectations are documented. Many organisations assume backup exists without checking retention, restore limits, or responsibilities.
10. Evidence can be shown to leadership. It is not enough for an MSP to say settings are in place. Someone should be able to show what is configured, what is monitored, and what still needs work.

What good looks like

A well-managed Microsoft 365 environment for an NFP is not complicated for the sake of it. It usually has a few visible characteristics:

• admin access is tightly controlled
• sensitive documents have clearer boundaries
• external sharing is intentional rather than accidental
• staff know what can be stored where
• offboarding is reliable
• there is a named owner for permissions, evidence, and periodic review

Good looks boring in the best possible way. There are fewer surprises, fewer exceptions, and less dependence on one provider or one technically confident staff member.

Red flags leaders should take seriously

The following are worth escalating quickly:

• nobody can explain who the global admins are
• board packs are emailed around rather than stored securely
• Teams and SharePoint permissions have grown without review
• leavers may still have access through personal devices or old accounts
• external sharing has never been checked
• the organisation cannot produce a simple evidence pack for leadership
• the MSP says everything is fine but cannot show settings, reports, or review history

Those signs do not automatically mean a breach has happened. They do mean the organisation is relying too much on assumption.

What to ask your IT provider

A smaller not-for-profit does not need enterprise jargon. It does need direct answers. Ask:

• Is MFA enforced for every account, including admins and board members?
• How many global admins do we have and why?
• How is external sharing controlled in Teams, SharePoint, and OneDrive?
• What happens when a staff member or contractor leaves?
• Are any emails being auto-forwarded outside the organisation?
• What Microsoft 365 evidence can you provide to the CEO or board today?
• What risks do you believe are still open in our environment?

If the answers are vague, overly technical, or unsupported by evidence, that is useful information in itself.

Board documents, client data, and funding evidence need extra care

Not all Microsoft 365 data carries the same consequence. For many NSW not-for-profits, the most sensitive material includes:

• client and case information
• referral forms and attached documents
• board papers and risk discussions
• HR files
• incident reports
• funding and compliance evidence

These should not be handled using the same loose sharing habits as general administration files. Even a simple folder and permissions review can materially reduce exposure.

First 30 days: where to start

A practical first month often looks like this:

1. Confirm all MFA coverage and admin-account separation.
2. Review global admins, shared mailboxes, and high-risk permissions.
3. Check external sharing defaults and open links.
4. Review offboarding steps and current dormant accounts.
5. Identify where client, board, and HR material is stored.
6. Ask for a simple evidence pack that leadership can understand.

That is often enough to separate immediate priorities from lower-value noise.

Microsoft 365 is a governance issue, not just a settings issue

This is the point many organisations miss. Microsoft 365 risk is not only about technical configuration. It is also about ownership, evidence, and leadership visibility. If the platform is central to client-data handling, reporting, and internal collaboration, then governance matters as much as the settings themselves.

That is why Microsoft 365 reviews often connect directly with broader questions about AI use, board cyber oversight, and whether anyone owns technology strategy above the ticket queue. See also AI Policy for Not-for-Profits: What Staff Can and Cannot Put Into ChatGPT or Copilot and Cyber Security Questions Every NSW Not-for-Profit Board Should Ask.

Next step

If you want a practical review rather than a generic checklist, book the NFP Technology Health Check NSW. It is built for smaller not-for-profits that need a board-ready view of Microsoft 365, cyber, AI, client-data, and reporting risk within a fixed scope.