Microsoft 365: seven configuration mistakes that put business data at risk

Microsoft 365 combines email, file storage, collaboration and identity. A setting that looks acceptable in isolation may become risky when combined with broad permissions or poorly governed external sharing.

Microsoft Secure Score can help teams track control adoption, but it is not a direct measure of breach probability and does not guarantee security. 1

1. Incomplete MFA coverage

Check multifactor authentication across employees, privileged users and documented exceptions. Where feasible, prefer phishing-resistant methods for sensitive accounts. Emergency access accounts require explicit safeguards and monitoring rather than improvised changes. 2

Evidence: dated policy export, covered populations and approved exclusions.

2. Conditional Access policies with gaps

A policy can exist without covering the intended users, applications or scenarios. Review activation status, exclusions, unmanaged devices, external access and the risk of accidental lockout. Available controls depend on Entra licensing and architecture. 2

Test: simulate representative sign-in scenarios before broad deployment.

3. Overly permissive SharePoint and OneDrive links

“Anyone with the link” sharing simplifies collaboration but can weaken individual accountability. Review site-level external sharing settings and consider authenticated guests for sensitive information. 3

Test: list sensitive sites, their sharing settings and active links.

4. Guest accounts that are never reviewed

A former contractor may retain access long after a project ends. Check guest users, business sponsors, group membership and revocation processes. External identity governance should cover onboarding, periodic reviews and offboarding. 4

Evidence: access review decisions and completed removals.

5. Third-party applications with excessive permissions

Apps integrated with Microsoft 365 can receive broad delegated or application permissions. Review consent grants, publishers, certificates, secrets and the minimum privileges required.

Test: assign a business owner to each integration and remove unnecessary grants only after assessing operational impact.

6. Logs that cannot support an investigation

Having logs is not enough. Teams need to know which events are recorded, how long they are retained, which licences are required and who receives alerts. Check whether an external share, privilege change or suspicious sign-in can be reconstructed.

Test: perform an authorised scenario and confirm that the security team can find the corresponding events.

7. Sensitive files without suitable sharing controls

A document library may have appropriate site permissions while still containing sensitive files shared too broadly. Review classification, data loss prevention controls, access conditions and actual usage. Microsoft documents these options for SharePoint and OneDrive. 5

Fictional example: a consulting firm

A consultancy has MFA enabled for employees and a reassuring Secure Score. A review nevertheless finds three issues: a former contractor still has guest access, a project site allows anonymous links, and a third-party app retains extensive file permissions.

The response is to identify accountable owners, remove unjustified access, restrict sharing for sensitive sites and test the business impact. A higher score alone would not validate the remediation.

Make the review repeatable

For each check, record the scope, expected setting, observed setting, risk, owner, action and retest date. Minimise personal data and avoid storing credentials in evidence packages.

These seven checks are neither an exhaustive audit nor a universal baseline. They provide a prioritised starting point to adapt to licensing, collaboration needs and data sensitivity.