Why Microsoft 365 Is Only as Secure as the Way You Configure It

We’ve lost count of the mid-sized businesses we meet that aren’t using their security tools properly. Take Microsoft 365. In our work with London and Windsor businesses, we see the same pattern over and over: a company pays for Microsoft 365 Business Premium, which includes a security stack that would have been called “enterprise-grade” five years ago, and uses maybe a fifth of what it offers.

This matters because Microsoft 365 has become something more than a productivity suite. It now includes a substantial security stack, most of which the typical business is licensed for but has never turned on.

The dashboard most admins haven’t opened

Microsoft maintains a built-in scoring system for every tenant called Secure Score. It measures your security posture against Microsoft’s own best practices, updates in real time, and benchmarks you against similar organizations. It’s included with every M365 subscription. Most admins we meet have never opened it.

The score itself isn’t the goal. Chasing 100% isn’t realistic, and some recommendations won’t apply to every business. What the dashboard gives you is a prioritized list of specific changes, each weighted by how much risk it addresses. If you’ve never had a structured look at your M365 security, it’s the single best place to start.

Identity is where the real risk lives

The biggest lever in most tenants is identity. Entra ID – Microsoft’s rebranded Azure Active Directory – is where you enforce multi-factor authentication, restrict sign-ins based on location or device, and decide who can do what. Microsoft’s own research shows that MFA blocks more than 99.2% of account compromise attacks, which is why Microsoft itself has started mandating MFA for admin access across Azure and the M365 admin centre.

But two distinctions matter here.

First, MFA availability and MFA enforcement are different problems. A tenant can have MFA turned on as an option and still have half its users signing in with just a password.

Second, Conditional Access – available on Business Premium and above – is where the real power lives. It lets you apply rules like “require MFA when someone signs in from a new country” or “block access entirely from unmanaged devices.” That’s contextual security, which is far more useful than the blunt instrument of applying the same rules to every sign-in.

The Defender and email tools most tenants never fully turn on

Microsoft Defender for Business covers the endpoint side: antivirus, endpoint detection and response, attack surface reduction, and vulnerability management. This is the kind of tooling that used to require a separate subscription to a dedicated cybersecurity platform. Many businesses still pay for a third-party antivirus that duplicates what Defender already does, because no one ever told them Defender was sitting inside their M365 license.

The email side has its own underused controls. SPF, DKIM, and DMARC prevent someone from spoofing your domain in a phishing campaign, but most tenants only get SPF configured and leave the other two off. Safe Links and Safe Attachments, which scan content before it reaches a user, are similarly left at defaults.

How many people hold the keys?

In many tenants we audit, four or five users have the Global Administrator role when two would be plenty. Global Admin access is the ultimate target for anyone trying to compromise your environment. It’s where policy lives, where backups can be disabled, where new users can be created silently. Keeping that role small, using separate accounts for admin work, and turning on Privileged Identity Management (which grants admin rights on a time-limited, justification-required basis) are all included in Microsoft 365 Business Premium.

Why does any of this go unused?

Most SMBs treat M365 as something their staff uses, not something that requires active management. The bigger reason, though, is by design. Microsoft’s defaults prioritize making the product work out of the box. File sharing is permissive. Legacy authentication is often still available. External users can be invited with minimal friction. Those defaults reduce onboarding complaints; they also leave every new tenant with the same predictable set of gaps.

Recent research from CoreView, based on a survey of 500 IT leaders at organizations with more than 1,000 Microsoft 365 users, found that 45% had experienced a security or compliance incident caused by Microsoft 365 misconfiguration in the past year. That’s the enterprise segment, companies with dedicated IT staff. The picture at the SMB end, where M365 administration often sits on top of someone’s existing job, tends to be more exposed rather than less.

The ongoing work problem

Configuring M365 properly once is useful, but keeping it configured correctly is the real work. Microsoft changes defaults, deprecates old features, and rolls out new security capabilities on a near-continuous basis. A tenant that was hardened 18 months ago may have drifted out of line with Microsoft’s current recommendations, and controls that weren’t available last year may now be the most important ones to turn on. This is where a managed IT partner earns its keep by staying current with Microsoft’s platform changes and keeping your environment tuned alongside them.

What to do next

If your business is paying for Microsoft 365 Business Premium and no one has reviewed your Secure Score, there’s almost certainly protection you’ve already paid for that’s sitting unused. At Attache Group, we help London and Windsor businesses audit their M365 configuration, close the gaps the defaults leave open, and keep the environment tuned as Microsoft updates the platform. A proper configuration review usually surfaces a handful of quick wins alongside the longer-term items – a cockpit check before you fly.

Book a complimentary IT assessment, and we’ll show you what’s already inside your M365 license and what’s not being used.