Microsoft 365 is where most SMEs keep everything: email, files, Teams conversations, client data. It's also, by a wide margin, where most of the breaches we get called in to clean up actually started. Not because M365 is insecure by design, but because it ships in a permissive default state that assumes you'll lock it down yourself, and most businesses never do.
Here are the five gaps that show up most often when we run a security review.
1. MFA that’s enabled, but not enforced everywhere
Plenty of businesses turn on multi-factor authentication and consider the job done. But MFA is only as strong as its coverage: if it's optional for certain accounts, exempted for "trusted" locations, or not applied to legacy protocols (POP, IMAP, older Outlook clients), attackers simply route around it. A single account without enforced MFA is often all it takes.
2. Legacy authentication still switched on
Older authentication protocols don't support modern MFA at all, and they remain one of the most common entry points for automated password-spray attacks. If you're not sure whether legacy auth is disabled in your tenant, it probably isn't. It's on by default and rarely gets touched unless someone specifically goes looking for it.
3. No conditional access policies
Conditional access lets you set rules like “block sign-ins from outside the UK” or “require a compliant device for admin access.” Without it, a stolen password is often all an attacker needs, from anywhere in the world, on any device. This is a Business Premium / E3-and-above feature that a huge number of licensed tenants simply never configure.
4. Too many global admins, with no monitoring
It’s common to find five, ten, sometimes more accounts with full global admin rights in a business with a handful of IT-literate staff, often because it was the easiest way to grant someone one specific permission, years ago, and nobody ever revoked it. Every global admin account is a full skeleton key to your tenant. The fewer there are, and the more closely they’re watched, the smaller that risk.
5. Forwarding rules nobody set up
This is the one that catches people out. A common attacker move, once they've compromised a mailbox, is to quietly set up a rule forwarding certain emails (invoices, password resets, anything with “payment” in the subject) to an external address, then sit and watch. It costs nothing to check your organisation for hidden forwarding rules, and it's one of the fastest ways to catch a live compromise before it costs you money.
The pattern behind all five
None of this is exotic. It's default configuration, left unreviewed. A proper Microsoft 365 security hardening pass, covering MFA enforcement, conditional access, admin account cleanup, and a forwarding-rule audit, closes most of it in a matter of days, not months.