Microsoft 365 ships with a reasonable security baseline, and that's exactly the problem. "Reasonable baseline" and "secure for your business" are two different things, and the gap between them is where we find most of our assessment findings.
The misconfigurations we see over and over
- Relying on Security Defaults alone. Security Defaults are a fine starting point, but they're one-size-fits-all. They don't let you tailor policies to risk level, device compliance, or specific applications, which most businesses need once they grow past a handful of employees.
- Legacy authentication still enabled. Protocols like POP3, IMAP, and SMTP AUTH predate modern MFA and can be used to bypass it entirely on mailboxes where they're still switched on.
- No conditional access policies blocking risky sign-ins. Without conditional access, a login from an unfamiliar country at 3am gets treated exactly the same as a login from the office at 10am.
- Unmonitored mailbox forwarding rules. A single forwarding rule quietly added to a compromised mailbox can leak every email that account receives for months before anyone notices.
- Wide-open external sharing in SharePoint and OneDrive. "Anyone with the link" sharing is convenient right up until a sensitive file ends up indexed somewhere it shouldn't be.
- Admin accounts without any privileged access management. Permanent, always-on global admin rights for several accounts, instead of just-in-time elevation when it's actually needed.
- Audit logging switched off or retained for too short a period. When something does go wrong, a 30-day log retention window often isn't long enough to reconstruct what actually happened.
The two settings that stop the most damage
If a client can only fix two things this month, we point them toward conditional access policies and mailbox forwarding monitoring. Conditional access is the single control most likely to stop a stolen credential from turning into a full account takeover, because it adds context, location, device health, risk level, that a password alone can't provide. Mailbox forwarding monitoring catches one of the quietest and most damaging forms of persistence an attacker can set up, often weeks before anyone would otherwise notice something was wrong.
Microsoft 365 security isn't hidden because it's complicated. It's hidden because it's spread across six different admin centers that nobody has time to check regularly.
Why this keeps happening
It's rarely negligence. It's usually a generalist IT person or managed service provider juggling password resets, printer issues, and a dozen other fires, with M365 security settings scattered across Entra, the Security admin center, Purview, and Exchange admin, each with its own menu structure. Nobody wakes up and decides to leave legacy auth enabled. It just never makes it to the top of anyone's list, because the list never ends.
That's exactly the gap continuous monitoring is built to close. Instead of waiting for an annual review or, worse, an incident, a standing assessment of your tenant catches drift as it happens, not six months after a setting quietly got changed back.