Cloud misconfiguration: The hidden security risk lurking in Microsoft 365

Articles on cybersecurity frequently focus on sophisticated AI-driven cyberattacks. However, a common cause of security breaches is far simpler: misconfiguration.

Many organisations have Microsoft 365 at the core of their business. Microsoft invests heavily in securing its platform, but under its shared responsibility model, it is up to you to correctly configure tools, settings and permissions. Successful attacks often occur because settings were not switched on, excessive permissions granted, or controls were poorly configured.

What is a cloud misconfiguration?

A cloud misconfiguration is a security setting, permission, policy or control that has been set up incorrectly, left at an insecure default, or changed and never put back. The result is that your cloud platform is less secure than it should be. It’s a bit like locking your front door when you go out but forgetting you’ve left a window open.

In Microsoft 365, misconfigurations can occur in Microsoft Entra ID, Exchange Online, SharePoint, OneDrive and Teams, as well as in Conditional Access policies, multi-factor authentication (MFA), external sharing settings and admin permissions.

Often, misconfigurations happen gradually, as an organisation grows and changes over time. If your business does not monitor and regularly review permissions and settings, they can result in significant security gaps.

Why misconfigurations pose a danger

Weak configurations or misconfigurations make life easy for cyber-attackers, leaving your company vulnerable to:

What are the most common Microsoft 365 misconfigurations?

MFA not enforced

MFA remains one of the most effective security controls, but it is rarely applied consistently. Temporary users, service accounts and specific departments are often excluded, and legacy authentication protocols bypass MFA entirely, giving attackers an easy way in. Standard MFA is also no longer enough on its own: phishing kits now routinely steal session tokens to get around it, so phishing-resistant methods such as passkeys, FIDO2 security keys or Windows Hello for Business should be used wherever possible, starting with admin accounts.

Unnecessary admin privileges

Very few users in a company actually need Global Admin access. However, over time, organisations often build up admin accounts they no longer need, and each account is a potential target for cyber-attackers. Microsoft recommends fewer than five Global Admins, with day-to-day work done using lower-privileged roles and, where licensed, admin access granted only when needed through Privileged Identity Management (PIM).

Inadequate external sharing controls

Microsoft 365 makes workplace collaboration easy with SharePoint and OneDrive, but this can come at a cost. Broad external sharing, anonymous links and unrestricted guest access can leave confidential information accessible to people outside your organisation, often without anyone realising. ‘Anyone’ links are particularly risky, as they can be forwarded freely and require no sign-in.

Weak email protection

Email remains one of the most common routes into a business. Microsoft’s 2026 Digital Defense Report found that phishing was the entry point for 23% of the intrusions it observed, more than triple the previous year. Without properly configured SPF, DKIM and DMARC records, with DMARC set to an enforcing policy rather than left at p=none, attackers can send emails that appear to come from your exact domain to customers and suppliers. These records won’t stop lookalike domains, so anti-phishing policies matter too. Automatic forwarding of email to external addresses should also be blocked, as it is a common way for attackers to quietly harvest mail after compromising an account.

Conditional Access gaps

Microsoft Entra Conditional Access is a powerful security feature, but many companies only deploy a handful of basic policies that are rarely reviewed. Without robust controls, users may be able to sign in from unmanaged devices or risky locations without any extra checks. Conditional Access requires Microsoft Entra ID P1, included in Microsoft 365 Business Premium and E3/E5. Organisations on lower licences should, as a minimum, enable Security Defaults.

Unrestricted third-party app consent

By default, users can often grant third-party apps access to their mailbox, files or calendar. Attackers exploit this with ‘consent phishing’, tricking users into approving a malicious app that keeps access even after a password reset. User consent should be restricted, with an admin approval process for new apps.

The issue with configuration drift

Even secure cloud environments can become vulnerable over time. This is known as configuration drift, where settings gradually move away from a secure baseline.

For example, an MFA exclusion is added for one user and never removed, or a sharing restriction is relaxed for a project and never restored. Six months or a year later, your environment may look quite different from where it started.

This is why cloud security is never just a one-off project.

Ways to reduce your risk

You can prevent most misconfigurations by following these six steps:

1. Regular assessments: Scheduling regular reviews of settings, permissions and identities will enable you to spot and remediate gaps in your security before cyber-attackers find them.
2. Improve identity security: Enforce MFA for all users (phishing-resistant for admins), block legacy authentication and use Conditional Access to minimise risky sign-ins.
3. Conduct frequent reviews of user access: Apply least privilege access to users and regularly audit privileged accounts to ensure appropriate access permissions are maintained.
4. Check sharing permissions (SharePoint, Teams and OneDrive): Ensure sensitive information can only be accessed by relevant, authorised users.
5. Monitor for changes: Make sure audit logging is enabled and set up alerts so you can swiftly identify unauthorised changes or configuration drift.
6. Align with recognised baselines: Use Microsoft Secure Score and the CIS Microsoft 365 Foundations Benchmark to measure your settings against recommended standards.