Most Microsoft 365 tenants are live within hours of purchase — provisioned quickly, with default settings, deployed by whoever had admin credentials first. That's understandable. What's less understandable is that those default settings often stay in place for months or years, quietly creating the conditions for a security incident.
Here are the five most common Microsoft 365 security misconfigurations we identify in SMB environments — and exactly how to fix each one.
1. Legacy Authentication Is Still Enabled
Legacy authentication protocols — Basic Auth, SMTP AUTH, IMAP with username and password — do not support modern authentication or MFA. If they're enabled in your tenant, an attacker who obtains a user's credentials can bypass any MFA policy you have in place.
Microsoft has been progressively disabling legacy authentication, but many tenants still have it partially enabled — especially for line-of-business applications, printers, or older email clients.
Fix: Use the Azure AD Sign-In report to identify any accounts using legacy authentication in the last 30 days. Block legacy authentication via a Conditional Access policy, and migrate affected systems to OAuth 2.0 or app passwords where necessary.
2. MFA Is Not Enforced Across All Users
Per-user MFA settings and Security Defaults are not equivalent to a properly configured Conditional Access policy. Organizations often believe MFA is "on" because Security Defaults are enabled — but exceptions, breakglass accounts, and service accounts frequently fall outside coverage.
Fix: Audit your Conditional Access policies. Ensure you have a policy enforcing MFA for all users, all cloud apps, with no excluded users outside of documented breakglass accounts. Regularly review sign-in logs for non-MFA sign-ins.
3. DMARC Is Not Configured or Is in Report-Only Mode
SPF and DKIM records tell receiving mail servers how to validate your outbound email. DMARC tells them what to do when validation fails. Without a DMARC policy of p=quarantine or p=reject, your domain can be spoofed — and most mail servers will deliver the spoofed message.
Fix: Start with p=none and aggregate reporting to identify all your outbound mail sources. Once legitimate sources are covered by SPF and DKIM, move to p=quarantine then p=reject. Do not leave DMARC in report-only mode permanently.
4. Global Admin Accounts Are Used for Daily Operations
Global Administrator is the highest privilege role in a Microsoft 365 tenant. It should not be the account used to answer email, manage Teams, or run reports. Every minute a Global Admin account is actively signed in is a window of elevated risk.
Fix: Create role-specific admin accounts for daily administration. Assign least-privilege roles (Exchange Admin, SharePoint Admin, etc.) to admins who need them. Reserve Global Admin for break-glass scenarios and protect those accounts with hardware MFA tokens.
5. Audit Logging Is Not Enabled
Microsoft 365 does not enable unified audit logging by default in all tenant types. Without it, there's no record of file access, permission changes, email forwarding rules, or admin actions — making incident response significantly harder and compliance obligations nearly impossible to meet.
Fix: Enable the Unified Audit Log in the Microsoft Purview compliance portal. Configure retention (90 days default; 365 days requires E3/E5 or add-on). Set up alert policies for high-risk events including forwarding rule creation, permission elevation, and mass file downloads.
If any of these gaps exist in your environment, a structured security assessment will surface them — along with everything else — in a written findings report in 3–5 business days.