The same Microsoft 365 security gaps come up again and again in security reviews, whatever the size or industry of the organization. Here are ten of the most common, with a fix for each.
1. MFA Not Enforced for All Users
Multi-Factor Authentication remains the single most impactful security control. Yet many organizations still have users who can sign in with just a password.
Fix: Enable Security Defaults in Entra ID, or deploy Conditional Access policies requiring MFA for all users.
2. Legacy Authentication Protocols Enabled
Protocols like POP3, IMAP, and SMTP Basic Auth bypass MFA entirely. Attackers actively exploit these in password spray campaigns.
Fix: Create a Conditional Access policy that blocks legacy authentication. Monitor sign-in logs for 30 days first to identify dependencies.
3. No Conditional Access Policies
Without Conditional Access, there's no way to enforce location-based restrictions, device compliance, or risk-based authentication.
Fix: Start with three baseline policies: Require MFA for admins, block legacy auth, and require MFA for risky sign-ins. Our Conditional Access baseline covers the full set and a safe rollout order.
4. External Sharing Over-Permissioned in SharePoint
Default SharePoint settings allow anyone with a link to access shared content — including external users without authentication.
Fix: Restrict external sharing to "Existing guests" or "Only people in your organization" at the tenant level. Use sensitivity labels for exceptions. Our SharePoint and OneDrive sharing guide covers each setting.
5. Mailbox Forwarding Rules to External Domains
Auto-forwarding rules are a favorite persistence mechanism for attackers who've compromised an account.
Fix: Block auto-forwarding to external domains via a transport rule in Exchange Online. Audit existing forwarding rules immediately.
6. No Admin Account Separation
Global Admins using the same accounts for daily email and web browsing creates unnecessary attack surface.
Fix: Create dedicated admin accounts (admin-user@domain.com) with no mailbox. Use Privileged Identity Management (PIM) for just-in-time access.
7. Audit Logging Not Enabled
Without unified audit logging, you can't investigate incidents or detect suspicious activity.
Fix: Enable Unified Audit Log in the Microsoft Purview compliance portal. Set retention to at least 90 days.
8. Default Password Policies Too Weak
Short password requirements and no banned password list leave accounts vulnerable to brute force attacks.
Fix: Require 14+ character passwords, enable Azure AD Password Protection with custom banned words, and disable password expiration (per NIST guidance).
9. No Data Loss Prevention Policies
Sensitive data like credit card numbers and SSNs can be shared freely via email, Teams, and SharePoint without any DLP controls.
Fix: Start with Microsoft's built-in DLP templates for financial data and PII. Apply to Exchange, SharePoint, and Teams.
10. Intune Device Compliance Not Configured
Even organizations with Intune often haven't configured compliance policies, meaning unmanaged and unpatched devices access corporate data freely.
Fix: Create baseline compliance policies requiring OS updates, encryption, and PIN/password. Pair with Conditional Access to block non-compliant devices.
How TenantVigil Helps
TenantVigil reads Microsoft 365 configuration and reports security check results across 90+ checks. The catalog includes checks for several of the misconfigurations above, and the report shows exactly what Microsoft returns for your tenant. Start free to see where one Microsoft 365 tenant stands; the Free plan requires a Microsoft work-account sign-in and administrator consent and covers one tenant.