Is Your Microsoft 365 Environment Secure?

The default settings in most Microsoft 365 tenants leave real gaps — here’s what to check first.

Itumeleng Dintwe | September 9, 2026

The False Security of Default Configurations

When organizations migrate to Microsoft 365 (M365), there is often a dangerous assumption that default configurations offer out-of-the-box enterprise-grade security. In reality, Microsoft operates under a Shared Responsibility Model [1]. While Microsoft maintains the physical cloud infrastructure, application availability, and underlying hardware, the customer remains entirely responsible for account identity management, access controls, data classification, and endpoint security [1], [2].

Because Microsoft prioritizes initial operational compatibility and user convenience during deployment, default M365 tenant settings frequently leave critical security gaps open to exploitation [2].

The 5 High-Risk M365 Default Settings to Audit Immediately

1. Legacy Authentication Protocols

    • The Gap: Legacy protocols such as POP3, IMAP4, and SMTP submission do not support Multi-Factor Authentication (MFA) [2].

    • The Risk: Threat actors utilize automated credential stuffing and brute-force attacks against legacy endpoints to bypass MFA rules enforced on modern web portals [3].

    • The Fix: Create a Conditional Access policy in Microsoft Entra ID (formerly Azure AD) to explicitly block legacy authentication across all tenant accounts [2], [3].

2. Absence of Enforced Conditional Access & Phishing-Resistant MFA

    • The Gap: Standard security defaults require basic MFA, but often omit location-based restrictions, device compliance checks, or risk-based access rules [2].

    • The Risk: Adversary-in-the-Middle (AiTM) phishing kits can intercept basic SMS or push-notification MFA tokens [3].

    • The Fix: Deploy Conditional Access policies enforcing FIDO2 keys or Microsoft Authenticator number-matching with location context for all privileged and standard accounts [2].

3. Over-Privileged Global Administrators

    • The Gap: Small-to-medium businesses frequently assign the “Global Administrator” role to multiple staff members or third-party service providers for routine administrative tasks [2].

    • The Risk: A single compromised Global Admin credential provides adversaries with unrestricted control over the entire domain, email system, and cloud storage [2], [3].

    • The Fix: Limit Global Admins to between 2 and 4 dedicated break-glass accounts [2]. Implement Role-Based Access Control (RBAC) and Privileged Identity Management (PIM) for daily IT administration [2].

4. Permissive External Sharing Settings

    • The Gap: Default SharePoint Online and OneDrive for Business settings permit users to generate “Anyone with the link” access URLs that do not require authentication [2].

    • The Risk: Sensitive corporate IP, financial files, and personal data can easily be exposed publicly or forwarded outside the business without auditing [2].

    • The Fix: Restrict external sharing links to “Specific people” or require external recipient authentication with expiration boundaries [2].

5. Disabled Unified Audit Logging (UAL) & Inadequate Log Retention

    • The Gap: In certain tenant licensing tiers, detailed audit logging may not be activated by default or log retention may be capped at short intervals [2], [4].

    • The Risk: In the event of a security incident, forensic investigations become impossible if historical sign-in logs and mailbox activity logs were never captured [4].

    • The Fix: Verify that Unified Audit Logging is explicitly turned on across the tenant and configure log ingestion into a centralized SIEM or longer-term storage vault [2], [4].