Discover four misconfigurations attackers rely on—and how to close them in weeks, not months.
An 8-Minute Read for IT Leaders
Most IT leaders we talk to are confident their Microsoft 365 and Azure environments are “basically secure.” And then we assess them.
We're seeing the same four critical security control gaps across almost every M365 and Azure assessment we conduct. These aren’t obscure edge cases, either; they’re foundational controls that quietly fail when environments grow faster than security governance.
The good news: these gaps are fixable. The bad news: attackers already know exactly where to look.
Quick hits:
Email misconfigurations are costing you deliverability and security
Your personal devices are exfiltrating corporate data right now
Orphaned privileged accounts create permanent backdoors
That "remote wipe" button doesn't work as well as you think
Below is a field-tested breakdown of the four most common Microsoft 365 and Azure security gaps and what to do about them now.
Email is still your primary business channel and one of your biggest risk surfaces.
In real-world assessments, we repeatedly find:
This isn’t just theoretical risk. Across the top 10 million internet domains, 61.9% have no SPF record, and only 7.6% enforce DMARC policies. The result? Your sales team send 100 prospecting emails and 45 never reach the inbox.
Poor authentication means:
Organizations with properly configured SPF, DKIM, and DMARC routinely see inbox placement rates above 85%. Without them, deliverability often drops below 50%.
Why this happens
What to do this week
This is one of the fastest security wins you’ll ever implement, and it pays dividends immediately.
This matters beyond security: Your sales compensation depends on email reaching prospects. This isn't just a security issue—it's a revenue issue. Make sure to bring this one up to the board!
Most organizations dramatically underestimate how much access they’ve already approved.
OAuth permissions are often granted by users clicking Accept without understanding that they’ve just authorized:
Once granted, OAuth tokens:
Recent OAuth impersonation campaigns hit 3,000+ user accounts across 900+ Microsoft 365 environments with >50% attack success rates.
We routinely see environments where third-party apps have broad permissions that no one remembers approving (and no one is monitoring!).
At the same time, corporate data is being synchronized to personal phones, tablets, and home computers. Full mailbox copies often live indefinitely on unmanaged devices.
When those devices are resold, lost, or discarded, the data goes with them.
What to do this week
If you haven’t reviewed OAuth permissions recently, assume you’re already exposed.
This is the one that keeps security teams up at night.
Around 15% of privileged accounts haven't been used in 180+ days. These orphaned accounts—forgotten service accounts, incomplete offboarding procedures, old vendor access—represent permanent backdoors.
A compromised Global Administrator can create new elevated roles, disable logging, exfiltrate email/SharePoint data for months undetected. Dark web markets auction corporate admin accounts for $100,000+.
Friendly reminder that a single compromised privileged account can:
And because they’re rarely used, suspicious activity often goes unnoticed.
Why this happens
What to do this week
Least privilege isn’t optional in cloud environments, it’s survival.
Many organizations believe they can remotely wipe data when employees leave. In practice, this only works under ideal conditions.
Remote wipe requires:
If a device is offline—or never enrolled—the wipe never happens.
Personal devices introduce additional blind spots:
We regularly see BYOD environments where users accessed Microsoft 365 from personal devices without any enforcement policies at all.
What to do this week
If you haven’t tested your offboarding process end‑to‑end, assume it doesn’t work.
You should consider cybersecurity help if you have:
Consider a hybrid approach: Use consultants for initial assessment and high-risk remediation while building internal capabilities.
If you do nothing else this month do these things, in order:
Security is not a one‑time project. It’s an operating discipline.
Start with Microsoft Secure Score "Quick Wins"—high-value improvements with minimal complexity:
Implementation best practice: Document current state, establish rollback plans, test in pilots before organization-wide deployment. Security improvements that break legitimate business operations generate help desk overload and erode leadership support.
These four gaps—email authentication failures, data exfiltration, identity management deficiencies, and ineffective access controls—represent real, exploitable weaknesses that attackers routinely leverage for initial compromise, privilege escalation, data theft, and persistent access.
Microsoft's platform provides robust security capabilities. The challenge is understanding what "proper configuration" means, sequencing changes to avoid disruption, and maintaining security over time as environments evolve.
Three paths forward:
Most importantly: recognize that security is an ongoing program, not a one-time project. Continuous monitoring, periodic assessment, and incremental improvement build the resilience that extends far beyond today's control gaps.
Your sales team's ability to reach customers, your data protection obligations, and your organizational risk posture depend on the decisions you make this week.
Ready for some external support with your configuration and hardening? Book a free 15 minute call with us.