Microsoft 365 Security Assessment: 10 Settings Most Companies Get Wrong
The 10 most common security mistakes in Microsoft 365: MFA, legacy authentication, mail forwarding, sharing, and admins. Audit your tenant.
A Microsoft 365 security assessment audits your tenant settings — accounts, email, SharePoint, Teams, and devices — against Microsoft best practices and real-world attack vectors. While Microsoft provides a secure platform, the company is responsible for its configuration. This is where we find the most vulnerabilities during audits.
TL;DR — Key Takeaways
- Default Microsoft 365 settings are not optimized for security.
- The most common errors involve MFA, admin accounts, and mail forwarding.
- Most remediations can be implemented without additional licenses.
- An audit is essential before deploying Copilot.
10 Most Common Mistakes
| # | Mistake | Risk |
|---|---|---|
| 1 | MFA not enforced for everyone | Account takeover via stolen passwords |
| 2 | Legacy authentication not disabled | MFA bypass |
| 3 | Too many Global Administrators | Increased blast radius during a breach |
| 4 | Admins without separate accounts | Attack via everyday productivity accounts |
| 5 | Automatic external mail forwarding enabled | Silent data exfiltration |
| 6 | Users allowed to consent to apps | Malicious OAuth applications |
| 7 | 'Anyone with the link' sharing enabled | Publicly accessible sensitive documents |
| 8 | Audit logs not being monitored | Intrusions go undetected |
| 9 | Lack of Conditional Access | Logins from untrusted devices or countries |
| 10 | No M365 backup | Data loss due to error or ransomware |
How to Quickly Check Your Status
- Open Microsoft Secure Score and review high-impact recommendations.
- Review the list of administrators in Entra ID.
- Check mail forwarding rules in Exchange Online.
- Review sharing settings in SharePoint.
- Check third-party app consents.
For MFA details, see our practical guide for MFA in Microsoft 365, and for Copilot, read our article on permissions before deploying Copilot.
Microsoft Entra IDIdentity as the foundation of security.FAQ
- How long does a Microsoft 365 assessment take?
- For smaller companies, it usually takes one to two days, including the report.
- Do we need additional licenses?
- Most fixes can be implemented with existing licenses; however, Business Premium enables Conditional Access and Intune.
- Will the assessment disrupt users?
- No. The audit is a read-only review of settings; changes are only performed upon agreement.
Related posts
Business Continuity Plan: What a BCP for SMEs Must Include
What do we do if nothing works tomorrow morning? A 10-page BCP is all you need.
IT SupportIT Infrastructure Documentation: What Needs to be Recorded and Why
If it isn't documented, it doesn't exist. The minimum documentation scope every company needs.
CybersecurityTwo-Factor Authentication: Implementation Without Employee Resistance
MFA stops the vast majority of stolen password attacks. Learn how to deploy it quickly and without complaints.