SPF
Add include:spf.protection.outlook.com to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.
A complete record with Microsoft 365 alone looks like v=spf1 include:spf.protection.outlook.com ~all. If you use other sending tools, their includes go in the same record.
DKIM
Found in Microsoft 365 Defender portal, under Email & collaboration, then Policies, then DKIM.
Microsoft uses two CNAME records rather than TXT, pointing at Microsoft-hosted keys. Publish both, then enable signing in the portal. The CNAME approach means Microsoft rotates the keys for you, which removes a whole category of later failure.
Microsoft 365 publishes keys under the selector selector1 and selector2, which is what an external check looks for.
DMARC
DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports for a few weeks, authorise everything legitimate, and only then tighten. The DMARC guide covers the order in detail, and the order is what stops you blocking your own invoices.
Worth knowing with Microsoft 365
Microsoft 365 tenants frequently have a second sending path through an on-premises server or a third-party filter. Both need to be in SPF, and the filter usually needs its own DKIM configuration.
Check it afterwards
Publishing the records is not the same as them working. Verify from outside: whether SPF passes, whether a DKIM signature is actually present, and how many lookups your SPF now performs. The free mail check answers all three in plain language.