On average, organizations have 30 known, high-risk misconfigurations sitting open, according to a recent Huntress/UserEvidence survey of IT and security professionals. Given this backlog and potential impact to end users, organizations often take a triage approach, addressing the most critical gaps first.

MFA coverage and enforcement gaps

Multi-factor authentication (MFA) is possibly the single most important fundamental control in Entra ID identity management. CISA estimates that MFA makes a user 99% less likely to be hacked. And yet, MFA is often not consistently enforced. A single account without MFA leaves your business vulnerable to a wide array of credential abuse tactics. While MFA is non-negotiable, mature environments should move away from legacy authentication methods (e.g., SMS, voice calls, and standard push notifications), which are vulnerable to interceptive and MFA fatigue attacks. Instead, enforce phishing-resistant MFA (e.g., FIDO2 security keys, Windows Hello for Business), especially for administrative accounts.

Conditional Access policies

Sophisticated attackers find other ways around standard MFA, such as adversary-in-the-middle (AiTM) attacks. Using toolkits like Tycoon 2FA, attackers set up a proxy server between the victim and the Microsoft login page. When the user logs in, the attacker intercepts their credentials and the authenticated session token. The user has no idea that anything shady occurred, while the attacker gains immediate access.

To guard against AiTM, Entra ID conditional access policies should evaluate signals such as the user’s location, device posture, and risky sign-in patterns rather than just relying on static login credentials. Many of the over-privileged identities and misconfigurations highlighted in the Known Gaps, Open Doors report can be mitigated with well-designed Conditional Access policies that block sign-ins from suspicious locations, untrusted VPNs, or unmanaged devices.

Global admin and privileged role assignments

In Microsoft 365 identity and access management, the Global Administrator role has unrestricted write access across all services. The more accounts that are permanently assigned this role, the greater the risk an organization runs of a tenant-wide compromise. It’s a good idea to have more than one Global Admin, but no more than necessary.

These accounts should be cloud-only identities and strictly separated from on-premises or federated identity providers. This air-gapping helps prevent an on-prem Active Directory compromise from escalating laterally into the cloud.

Except for carefully controlled “break glass” accounts, organizations should avoid standing Global Administrator privileges. Through just-in-time (JIT) access via privileged identity management (PIM), organizations can restrict escalated privileges to a specific window for a task, then revoke them after completion.

Stale accounts and inactive users

A common and high-risk attack vector, dormant accounts accumulate when employees turn over, contractor projects end, or test accounts are left active. These accounts are risky because they often go unnoticed by day-to-day security monitoring. Older accounts may even predate modern MFA requirements, making them susceptible to credential stuffing or exploitation for lateral movement and privilege escalation.

Accounts that haven’t been logged into for six months should be disabled for several weeks to test for operational disruption, then removed or archived according to organizational retention requirements.

Risky mailbox forwarding rules

Business Email Compromise (BEC) is a primary threat to organizations. Once an attacker accesses a corporate email account, they can use it to phish other employees or initiate fraudulent transactions. They typically do this by setting up mailbox rules that forward emails containing terms like “invoice” or “payment” to an attacker-controlled domain then injecting themselves into the billing process. Automatic email forwarding to remote domains should be disabled unless explicitly authorized for verified partner domains.

Once the highest-priority risks are addressed, organizations can continue with the next phase of Microsoft 365 identity management to lock down other relevant security gaps.

Guest access and external sharing

In today’s interconnected business environment, where organizations share sensitive data with third-party vendors and contractors, guest user accounts must be tightly managed. Too often, these accounts retain access to internal directories long after the collaboration has ended. Unrestricted privileges allow external actors to run directory queries, discover employee details, and harvest internal emails for phishing targets. Guest users should be restricted to the directory visibility and resources necessary for their business purposes. The ability to invite guest users must be restricted to select accounts.

App consent permissions

Stealthware and other malicious OAuth apps are yet another technique attackers use to bypass MFA. In this scenario, threat actors create a fake app in their own Microsoft tenant and give it powerful permissions. They then send a phishing email with a link that triggers a legitimate Microsoft pop-up asking if the user wants to grant the app access permissions. Clicking “accept” allows the hacker to slip into the user’s Outlook or OneDrive whenever they want.

While Microsoft now restricts regular users from approving risky third-party apps by default, this change doesn’t revoke permissions that were already granted in the past. Security teams should audit existing “shadow OAuth” to find any existing risky application grants. Additionally, organizations should enable the Admin Consent Workflow so employees can request apps for admin review.

Service accounts

Just as stale accounts can often be neglected, non-human service accounts can slip past security controls. These identities are created for integrations, scripts, and background applications and can easily outnumber human users. They’re also inherently risky, being rarely reviewed, frequently undocumented, and typically unable to perform interactive MFA. Service accounts must be regularly audited, and organizations should apply conditional access to restrict account authentication to verified source IP ranges or managed resources.

Legacy authentication

Legacy authentication protocols (e.g., POP, IMAP, SMTP AUTH) don’t support MFA or modern device compliance checks. Despite being widely deprecated, these protocols are still frequently exploited in credential stuffing and password spray attempts. While Microsoft has turned off basic authentication by default for most tenants, legacy protocols can sometimes be inadvertently re-enabled for specific business exceptions. Organizations should use conditional access to block legacy protocols globally as a safety net.

Audit logging and alerting coverage

Security telemetry and comprehensive log retention are critical for preventing security blind spots—which is why attackers will often attempt to disable logs or otherwise manipulate settings to conceal their activity.

Organizations should enable unified audit logging (UAL) across the Microsoft 365 tenant and configure Entra ID to forward essential log types (e.g., AuditLogs, SignInLogs, RiskyUsers) to a centralized security operations center (SOC) or Security Information and Event Management (SIEM) tool for threat analysis and active alerting.

Very few aspects of cybersecurity are set-and-forget, and SaaS environments are especially dynamic. An environment that’s secure today can become insecure tomorrow.

Microsoft 365 environments change constantly

Microsoft 365 itself is a continuously evolving ecosystem. New background security features, default tenant settings, collaboration tools, and software integrations are regularly added, often without the explicit awareness or formal review of IT leadership. These changes can have unexpected consequences elsewhere, including side effects on Conditional Access, guest access, or app consent policies.

Business exceptions can weaken the baseline

Security exceptions, even when intended to be temporary, can greatly weaken security posture. For example, syncing systems with a third party—such as onboarding a new vendor or integrating an acquired company—may require temporary legacy protocol access. Similarly, a contractor may be temporarily excluded from an MFA policy to execute an urgent database integration. These “temporary” exceptions are often not documented or scheduled to be revoked, leaving security gaps that are soon forgotten—until they’re exploited.

Drift creates new openings after initial hardening

Forgotten exceptions are just one way that security posture gradually drifts from a hardened baseline. Administrative updates, role changes, and ad hoc troubleshooting all chip away at an environment’s security posture unless proactively monitored and corrected.

Defending against identity-centric threats demands defense-in-depth. The Huntress agentic security platform tackles identity attacks in two ways: Our Managed ISPM continuously hardens your Microsoft 365 environment by finding and fixing misconfigurations, risky access, and policy drift—and enforcing expert-defined policies across Entra, Exchange, SharePoint, and more. Managed ITDR helps to rapidly detect and respond when suspicious identity activity appears. Learn more about how Huntress helps your organization guard against today’s sophisticated identity threats.