Use of Microsoft 365 is common among organizations. Unfortunately, so are misconfigurations.

MFA not enforced consistently

Multi-factor authentication (MFA) is the single most effective technical control for preventing account takeover, stopping 99% of automated attacks. But merely having MFA isn't enough if it's not enforced consistently across all users and applications. Inconsistent enforcement can arise through "security defaults" that have been disabled or "conditional access" policies that contain broad exclusions. For example, an organization might require MFA for standard users but exclude service accounts or legacy applications.

The type of MFA is also critical. Modern techniques like push bombing and adversary-in-the-middle (AitM) phishing can bypass weaker MFA methods. High-risk organizations should prioritize phishing-resistant MFA, such as FIDO2 security keys or Windows Hello for Business.

Excessive admin privileges

Administrative privileges in Microsoft 365, particularly the Global Administrator (GA) role, have extensive control over the environment. A common misconfiguration is assigning GA privileges to too many individuals or using these accounts for routine, non-administrative tasks. If any of these users are compromised while performing daily tasks, like checking email or web browsing, the attacker immediately gains a critical level of access.

Privileged identity management (PIM) or just-in-time (JIT) access can limit this vulnerability by granting admin privileges for a set task and immediately revoke it afterwards.

Legacy authentication left enabled

Legacy Basic authentication methods for connecting to Exchange Online—such as POP3, IMAP, and SMTP AUTH using Basic auth—don't support modern authentication (OAuth), meaning you can't enforce MFA on those sessions. Even if you've rolled out MFA broadly, leaving Basic auth enabled for these protocols gives attackers a way to bypass it with password spray or credential stuffing attacks.

Risky mailbox forwarding rules

Once an attacker takes over a mailbox, they quickly establish persistence and data collection, often by creating an automatic mailbox forwarding rule. This sends a copy of any incoming or outgoing email to the attacker. They can then mine these messages for invoices to manipulate or sensitive data to exfiltrate. They also use inbox rules to hide their tracks—for example, creating rules that automatically move security alerts to hidden folders. Many Microsoft 365 tenants now block automatic external forwarding by default, but this setting is often changed to support a business need (e.g., forwarding helpdesk mail to an external CRM) or was never enforced in older environments. Other misconfigurations include improperly configured alerts for new rule creation.

Weak sharing and access settings

Microsoft 365's sharing settings often prioritize frictionless collaboration over security. "Anyone with the link" settings in SharePoint and OneDrive allow users to generate anonymous links to sensitive files. These links can be forwarded to anyone on the internet, with limited visibility into who accesses the data. Failing to restrict external access or monitor guest user permissions opens the door for attackers to exfiltrate sensitive data, upload malicious files, and harvest metadata for spear-phishing.

Microsoft 365 misconfiguration risks go beyond initial access to long-term exploitation. Because they allow attackers to log in as legitimate users, an intruder's actions are naturally more stealthy. They can remain undetected for an extended period while they quietly escalate privileges and further modify configurations to establish persistence.

In busy environments, where IT teams are frequently understaffed and overwhelmed by ticket volumes, security settings are often "set and forget." This allows configuration drift to creep in. An admin might temporarily lower a security setting to troubleshoot a user's access issue and then forget to change it back. Alternatively, a Microsoft update might introduce new features or settings that aren't covered by existing policies. Controlling this drift requires Microsoft 365 configuration monitoring.

To protect your business, start here when you begin evaluating your Microsoft 365 security settings.

Identity and authentication settings

Hardening identities is the first line of defense. Organizations should conduct a comprehensive audit of authentication methods, including:

• For higher-security environments, consider phasing out SMS and voice-based MFA in favor of the Microsoft Authenticator app or FIDO2 keys.
• Blocking all legacy authentication protocols at the tenant level.
• Implementing conditional access policies that block high-risk sign-ins and require MFA for all access to cloud apps.

A tool like identity security posture management (ISPM) can continually monitor for identity-related risks—such as misconfigurations, excessive privileges, dormant accounts, and policy gaps.

Admin role assignments

The principle of least privilege (PoLP) should be strictly enforced.

• Review and reduce the number of Global Administrators to the minimum viable number.
• Move administrative tasks to service-specific roles (e.g., SharePoint Administrator, Exchange Administrator) rather than using Global Admin for everything.
• Audit "standing access" and implement JIT access for highly privileged roles.

Mail flow and forwarding behavior

Exchange Online settings should be reviewed to prevent data exfiltration. Key steps include:

• Disabling automatic forwarding to external domains (found in the Exchange Admin Center's "Remote Domains" section).
• Regularly auditing user-created inbox rules for suspicious patterns, especially keywords related to financial transactions or security alerts.
• Configuring email authentication protocols (SPF, DKIM, and DMARC) to prevent domain spoofing.

Logging and monitoring coverage

In security, visibility is everything, whether for monitoring configurations, detecting threats, or proving compliance.

Microsoft 365 configuration monitoring can be done at a high level with the "Secure Score" and "Compliance Manager." For deeper monitoring, admins can use Microsoft 365 DSC (Desired State Configuration) to enforce baselines or the Tenant Configuration Management (TCM) APIs to track changes across Entra ID, Teams, and Exchange.

Verify that unified audit logging is enabled and that logs are being retained for a period that matches your compliance requirements. For most non-E5 licenses, Microsoft 365 Audit (Standard) now retains unified audit logs for 180 days by default, while E5 and Microsoft Purview Audit (Premium) extend retention to one year or more. Many organizations still export logs or forward them to a SIEM when they need longer retention.

While ensuring proper configurations is a critical first step, a defense-in-depth approach adds a layer by ensuring that any identity compromise is stopped quickly before the attacker can cause harm. A managed Identity threat detection and response (ITDR) solution such as Huntress Managed ITDR enables real-time monitoring for identity-based anomalies, such as "impossible travel" (a user logging in from New York and then London ten minutes later). Patterns like mass file downloads from SharePoint or OneDrive are best surfaced through Microsoft Purview alerts or SIEM queries that correlate file-access events. They can then be investigated alongside identity telemetry from tools like Managed ITDR.

Identity threats are notoriously difficult to uncover because they can look like legitimate user activity. This allows attackers to go undetected for long periods while they escalate privileges, move laterally, and zero in on high-value assets.

Huntress Managed ITDR helps detect and respond to suspicious identity and Microsoft 365 activity before it turns into a bigger compromise. By identifying the subtle signs of compromise—such as an unauthorized inbox rule or abnormal login patterns —our ITDR and 24/7 SOC help cut attacker dwell time. Alerts are human-validated and enriched with context so analysts can detect attacks that automated tools might miss, reduce false positives, and support fast containment.