Microsoft 365 Security Assessment: 10 Settings Most Companies Get Wrong
The 10 most common security mistakes in Microsoft 365: MFA, legacy authentication, mail forwarding, sharing, and admins. Audit your tenant.
A Microsoft 365 security assessment audits your tenant settings — accounts, email, SharePoint, Teams, and devices — against Microsoft best practices and real-world attack vectors. While Microsoft provides a secure platform, the company is responsible for its configuration. This is where we find the most vulnerabilities during audits.
TL;DR — Key Takeaways
- Default Microsoft 365 settings are not optimized for security.
- The most common errors involve MFA, admin accounts, and mail forwarding.
- Most remediations can be implemented without additional licenses.
- An audit is essential before deploying Copilot.
10 Most Common Mistakes
| # | Mistake | Risk |
|---|---|---|
| 1 | MFA not enforced for everyone | Account takeover via stolen passwords |
| 2 | Legacy authentication not disabled | MFA bypass |
| 3 | Too many Global Administrators | Increased blast radius during a breach |
| 4 | Admins without separate accounts | Attack via everyday productivity accounts |
| 5 | Automatic external mail forwarding enabled | Silent data exfiltration |
| 6 | Users allowed to consent to apps | Malicious OAuth applications |
| 7 | 'Anyone with the link' sharing enabled | Publicly accessible sensitive documents |
| 8 | Audit logs not being monitored | Intrusions go undetected |
| 9 | Lack of Conditional Access | Logins from untrusted devices or countries |
| 10 | No M365 backup | Data loss due to error or ransomware |
How to Quickly Check Your Status
- Open Microsoft Secure Score and review high-impact recommendations.
- Review the list of administrators in Entra ID.
- Check mail forwarding rules in Exchange Online.
- Review sharing settings in SharePoint.
- Check third-party app consents.
For MFA details, see our practical guide for MFA in Microsoft 365, and for Copilot, read our article on permissions before deploying Copilot.
Microsoft Entra IDIdentity as the foundation of security.FAQ
- How long does a Microsoft 365 assessment take?
- For smaller companies, it usually takes one to two days, including the report.
- Do we need additional licenses?
- Most fixes can be implemented with existing licenses; however, Business Premium enables Conditional Access and Intune.
- Will the assessment disrupt users?
- No. The audit is a read-only review of settings; changes are only performed upon agreement.
Sorodne objave
Microsoft 365 Backups: Why Microsoft Is Not Your Backup Solution
The Shared Responsibility Model means your data is your concern. Here is what that means in practice.
Cloud & Microsoft 365Varnostne kopije Microsoft 365: zakaj Microsoft ni vaš backup
Model deljene odgovornosti pomeni, da so vaši podatki vaša skrb. Kaj to pomeni v praksi.
Cloud & Microsoft 365Microsoft 365 Backup: Warum Microsoft nicht Ihr Backup ist
Das Modell der geteilten Verantwortung bedeutet, dass Ihre Daten in Ihrer Verantwortung liegen. Was das in der Praxis bedeutet.