The one report to check weekly.

If you only do one security thing for your small business on a regular cadence, make it checking the Microsoft 365 sign-in report. It takes five minutes a week, and it catches almost every form of account takeover before it becomes a real incident.

Why this report is so useful

Every login to M365 — yours, your staff's, service accounts, apps — shows up in this log. Location, device, app, success or failure. A trained eye can scan it in minutes and immediately spot anomalies: a login from a country no one travels to, a user logging in at 3 AM from two places at once, a service account suddenly used from a new location.

What we look for

The five-minute weekly habit

• Open the Microsoft Entra ID (admin center) Sign-in logs every Monday.
• Filter for failed logins — bursts of failures on one account signal brute force attempts.
• Look for foreign or unusual locations, especially on executives and finance staff.
• Look for impossible travel — same user, two distant locations, short time gap.
• Investigate anything weird by calling the user. Reset credentials and MFA if needed.