Securing Microsoft 365: The Typical Gaps After a Standard Setup
A new Microsoft 365 tenant, meaning your company’s Microsoft 365 environment with all its accounts and data, is fully functional right after setup, but not automatically well secured. Six verifiable points show where the typical gaps lie and how to close them.
Why the Standard Setup Is Not Enough
Microsoft 365 is ready to use immediately after initial setup: email works, files sit in the cloud, Teams runs. Precisely this quick readiness leads to a misunderstanding. Many decision makers assume that a product of this scale is securely configured out of the box. In fact, many default settings are designed for compatibility and convenience, not for the level of protection a company needs.
For attackers, Microsoft 365 accounts are a rewarding target because a single password often sits in front of the entire digital company: email traffic, file storage, calendars, and contacts. Whoever takes over a mailbox can manipulate invoices, impersonate the management, or quietly read along. Many of these attacks exploit no technical vulnerabilities but rather weak or stolen credentials and generous default settings.
The good news: the most important gaps can be closed with built-in tools. This article is structured as a checklist. For each of the six points you will find a specific question that you or your IT service provider can answer with yes or no, along with the corresponding action steps.
Point 1: Multi-Factor Authentication for All Accounts
The check question is: is multi-factor authentication active for all accounts without exception? Multi-factor authentication, often abbreviated as MFA, means that signing in requires a second proof in addition to the password, for example a confirmation in an app on your smartphone. A stolen password alone is then no longer enough to sign in.
Passwords fall into the wrong hands surprisingly easily: through phishing, meaning fake sign-in pages and emails, through passwords reused across services and exposed in third-party data breaches, or simply through trial and error. MFA is therefore considered one of the most effective single measures on this list. The decisive words are “without exception”: management accounts and function mailboxes such as info@ or accounting@ are often exempted, yet they are especially attractive to attackers.
In practice, you check this in the Entra admin center, the central management for user accounts in Microsoft 365. Smaller environments activate the security defaults there, a prefabricated package that enforces MFA for everyone. If you want finer control, such as stricter rules for administrators or exceptions for specific locations, you use Conditional Access, a set of rules that decides on each sign-in depending on the situation and requires a corresponding license. Prefer confirmation via app over SMS, since text messages are easier to intercept.
Point 2: Separate Administrator Accounts From Day-to-Day Work
The check question is: does nobody work day to day with an account that holds administrator rights? A global administrator can do practically anything in Microsoft 365: create accounts, view mailboxes, change rules, delete data. If that account is also used for daily email, every phishing message lands directly in an account with full access.
The solution is organizationally simple: every person who takes on administrative tasks receives a separate, second account for that purpose, without a mailbox and without an Office license. The everyday account remains a normal user account. In addition: as few global administrators as possible; in small companies, two are usually enough. For clearly defined tasks such as user management or password resets, there are restricted roles that are sufficient and offer less attack surface if things go wrong.
A documented emergency account, sometimes called a break-glass account, is also sensible: an additional administrator account with a very long password that is stored securely and is only used when all other access is locked out, for example after a mistake in the sign-in rules. You can check the current state yourself at any time: the list of administrator roles in the admin center shows how many accounts hold elevated rights and whether everyday mailboxes sit behind them.
Point 3: Forwarding Rules as a Silent Entry Point
The check question is: is automatic forwarding to external addresses blocked, and are new mailbox rules monitored? The background: attackers who have taken over a mailbox often first set up an inconspicuous rule that copies incoming email to an external address. The victim keeps working normally while the attacker reads along for weeks and waits for the right moment, for example to slip in an invoice with changed bank details.
Without active monitoring, such rules are barely noticeable, because they change nothing about the visible behavior of the mailbox. That is why this point belongs on every checklist, even though it is far less well known than multi-factor authentication.
Specifically: in Exchange Online, the email service of Microsoft 365, block automatic external forwarding centrally via the outbound spam policy. Then have the existing mailbox rules of all users evaluated once to find legacy issues. Finally, set up a notification that raises the alarm as soon as someone creates a new forwarding rule. The central block takes only a few clicks; evaluating existing rules requires some scripting experience and is a typical point where external support saves time.
Point 4: Keep an Eye on External Sharing
The check question is: do you know which files and folders are currently shared with people outside the company? OneDrive, SharePoint, and Teams make sharing very easy, including with external parties. Links of the “Anyone with the link” kind are particularly risky: they work without signing in, can be passed on at will, and in the default setting never expire.
In practice, shares accumulate over months that nobody keeps track of anymore: the folder for a former service provider, the costing for a prospective customer, the guest account of a departed project partner. A guest account is a separate account for external parties within your own Microsoft 365 tenant that, without maintenance, persists indefinitely.
Three steps create order. First, change the default: specify in the SharePoint admin center that new sharing links require sign-in by default, and give anonymous links an expiration date if they remain necessary. Second, review the current state: the built-in reports show existing external shares per site. Third, establish a rhythm: once per quarter, go through guest accounts and external shares and remove everything that no longer serves a current purpose.
Point 5: Data Backup: What Microsoft Covers and What It Does Not
The check question is: does a separate, regularly tested backup of your Microsoft 365 data exist? A widespread assumption is that Microsoft backs up everything automatically anyway. That assumption is right on one point and wrong on another, and the distinction matters.
What is true: Microsoft operates the infrastructure with high resilience and stores data with multiple redundancy. Your data is therefore well protected against the failure of a data center. What is false is the conclusion that this also amounts to a backup in the classic sense. Microsoft itself describes this as shared responsibility: the provider is responsible for operating the platform, while the customer remains responsible for their data and accounts. Against accidental deletion, deliberate sabotage, encryption by malware or faulty synchronization, the provider’s redundancy does not help, because it reliably replicates the damage as well.
Recycle bins and retention policies in Microsoft 365 mitigate the problem, but they are time-limited and no substitute for a backup from which mailboxes, files, and Teams content can be restored selectively to an earlier state. The usual approach is a separate third-party backup solution that regularly backs up Exchange, OneDrive, SharePoint, and Teams to an independent storage location. Just as important as the backup itself: test the restore at least once a year, because a backup from which nothing has ever been recovered is only a hope.
Point 6: Switch On Logging and Keep At It
The check question is: is the audit log active, and does someone look into it regularly? The audit log records who did what and when in the tenant: sign-ins, rule changes, shares, deletions. Without these records, it is hardly possible to reconstruct after an incident what happened and which data was affected. With Enterprise licenses, logging is generally already active; with the Business licenses common in mid-sized companies (Business Basic, Standard, and Premium), according to Microsoft it has to be switched on manually. You should not simply rely on either: the status can be checked in the Microsoft Purview portal, the administration area for compliance topics, in a few minutes.
Logs are only useful if someone reacts to them. Therefore, set up alert policies, meaning automatic notifications for critical events such as new forwarding rules, newly granted administrator rights, or a conspicuous number of failed sign-ins. Also note that the retention period of the logs is limited depending on the license, and clarify the evaluation of user activity in advance with your data protection officer.
That completes the checklist: multi-factor authentication for everyone, separate administrator accounts, blocked external forwarding, controlled sharing, a separate data backup, and active logging. Technically experienced managers can activate the security defaults, review administrator roles, and block forwarding themselves. For Conditional Access, the evaluation of existing rules and shares, and the selection and testing of a backup solution, support makes sense, because mistakes here either lock users out or leave gaps open.
The short version
Microsoft 365 ships with solid security tools, but they only take effect once someone switches them on and checks them regularly. The six points on this list cover the gaps that most frequently remain open after a standard setup. If you would rather not go through the check on your own, Ruknova, based in Schwerin, supports you with it, Germany-wide and available Mon-Fri 8 am to 4 pm.