Misconfiguration is widely considered one of the leading causes of cloud security incidents today, ahead of most traditional software exploits. That tracks with what we see in client environments. Nobody is defeating encryption or reverse-engineering an application. They're finding a setting that someone flipped for convenience, during a busy week, and never flipped back.
The misconfigurations we find most often
- Public storage and "anyone with the link" sharing. A SharePoint site or storage container set to anonymous access for a one-time external share, left that way indefinitely.
- Over-permissioned service principals and app registrations. An application granted far broader permissions than it actually needs, often because it was faster to approve during setup than to scope it down correctly.
- Unused admin roles that never got revoked. Someone was given temporary elevated access for a project eight months ago, and it's still active.
- Missing conditional access on privileged roles specifically. General users are protected, but global admins and other high-privilege roles don't have the stricter policies they actually need.
- Default encryption and logging settings left untouched. Not necessarily insecure out of the box, but rarely tuned to match what your business actually needs to detect and investigate.
- Cross-tenant access misconfigured, allowing broader trust with partner organizations than was ever intended.
Why these slip through
Part of it is sprawl. Cloud environments grow fast, new apps get connected, new sharing links get created, new service accounts get spun up for a project, and nobody is assigned to go back and clean up after the project ends. Part of it is a basic misunderstanding of the shared responsibility model: Microsoft and Azure secure the underlying infrastructure, but how you configure your tenant on top of that infrastructure is entirely on you. A secure platform with an insecure configuration is still an insecure environment.
The cloud provider secures the building. You’re still responsible for locking your own office door.
Getting ahead of it
- Review configurations on a schedule, not just once during initial setup. Cloud security posture management tools can automate a lot of this continuously.
- Scope app registrations to least privilege, and review them periodically rather than assuming they're still appropriate a year later.
- Run periodic access reviews for anyone with elevated or admin-level roles, confirming the access is still actually needed.
- Set up automated alerts for new external sharing, so a risky link doesn't sit unnoticed for months.
- Treat conditional access as a living policy, reviewed quarterly as your team, your apps, and your risk profile change.
The uncomfortable truth is that a cloud environment is never "done" from a security standpoint. It drifts constantly as people do their jobs. The only real defense is checking in often enough that the drift gets caught before someone else finds it first.