Microsoft 365 Admin Mistakes That Quietly Create Security Gaps

Most companies running Microsoft 365 never touch the admin center after the initial setup. Licenses get assigned, mailboxes get created, and the tenant runs quietly in the background for years. The problem is that the default configuration was never designed to stay secure indefinitely. It was designed to get a new tenant working with the fewest support calls, and several of those defaults sit exactly where attackers look first.

Why These Gaps Stay Invisible Until Something Breaks

A misconfigured Microsoft 365 tenant doesn't announce itself. Nothing crashes, nothing slows down, and nobody gets an error message. The tenant keeps working normally right up until a compromised account is used to redirect a wire transfer or exfiltrate a client list, at which point the setting that allowed it has usually been sitting untouched for years. A 2026 industry survey of Microsoft 365 environments found that 45% of large organizations had experienced a security or compliance incident tied to a misconfiguration in the past twelve months, and 87% had multi-factor authentication disabled for at least some administrator accounts. Those aren't obscure edge cases. They're default states that a lot of tenants never move away from.

The pattern shows up most in companies between 25 and 200 employees. Below that range, a single person usually understands the whole tenant by memory. Above it, most companies have been forced into a formal identity and access review by a client's security questionnaire, a cyber insurance renewal, or a compliance framework. The growth-stage middle is where a tenant configured once during initial rollout keeps running unreviewed for years, because nobody has been assigned to own it and nothing has forced a second look.

Mistake 1: Legacy Authentication Protocols Are Still Enabled

Legacy authentication covers older protocols such as POP3, IMAP, and basic-auth SMTP that were built before multi-factor authentication existed. These protocols have no way to prompt for a second factor, so an account protected by MFA everywhere else is still fully exposed through any legacy protocol left switched on. The Cybersecurity and Infrastructure Security Agency's secure configuration baseline for Microsoft 365 identifies blocking legacy authentication through Conditional Access as one of the highest-impact single changes a tenant can make, precisely because it closes a door that MFA cannot close on its own.

Microsoft has been retiring these protocols by default for new tenants, but any tenant created before that shift, or any tenant with a legacy app or scanner still depending on one of these protocols, often has it re-enabled somewhere. The fix is a Conditional Access policy that blocks legacy authentication tenant-wide, tested in report-only mode first to catch any application that still depends on it before the block goes live.

Mistake 2: Admin Accounts Don't Have Stronger Protection Than Regular Users

Global administrator accounts can create other admins, change security policy, and access every mailbox in the tenant. They are also, in a large share of real tenants, protected by the exact same single-factor login as a standard user account. Microsoft's 2025 Digital Defense Report found that more than 97% of identity-based attacks were password spray attempts, where an attacker tries a small number of common passwords across a large number of accounts. In the same report, only 1.5% of login attempts using correct credentials were blocked, and that block came from MFA. An admin account without MFA is a single correctly guessed password away from full tenant compromise.

The fix is not just requiring MFA on admin accounts. It's requiring phishing-resistant MFA, such as a hardware key or an authenticator app with number matching, rather than SMS or a push notification that can be defeated by MFA fatigue attacks. It also means keeping the number of standing global administrators as small as the organization can operate with, and using Azure AD Privileged Identity Management or a similar just-in-time elevation model for anyone who only needs admin rights occasionally.

Mistake 3: Mailbox Forwarding Rules Nobody Is Watching

Once an attacker gains access to a single mailbox, one of the most common next moves is creating a forwarding rule that silently copies incoming mail, often filtered to messages containing words like "invoice," "wire," or "payment," to an external address. The mailbox owner keeps receiving mail normally and has no reason to notice anything wrong. This is the mechanism behind most business email compromise fraud, and it survives a password reset because the rule itself, not the credential, is what's doing the damage.

Most tenants have no process for reviewing forwarding rules unless something has already gone wrong. The fix is a Conditional Access or Exchange transport rule that blocks auto-forwarding to external domains by default, combined with an alert policy that flags any new forwarding rule the moment it's created so an admin can review it within hours instead of discovering it after a fraudulent transfer has already cleared.

Mistake 4: External Sharing and Guest Access Are Left at Default

SharePoint and OneDrive ship with sharing settings that make it easy for any user to share a file or folder with anyone outside the company, often with no expiration date on the link. That default is convenient for a small team collaborating with a handful of known vendors. It becomes a real liability once a company has dozens of guest accounts accumulated over years, many belonging to people who left their own organization long ago and whose credentials may since have been compromised elsewhere.

The fix is narrowing external sharing to specific approved domains rather than "anyone with the link," setting expiration dates on external sharing links by default, and running a quarterly review that removes guest accounts no longer tied to an active business relationship.

Mistake 5: Audit Logging Is Off, or Nobody Is Looking at It

Microsoft 365's unified audit log records sign-ins, mailbox rule changes, admin actions, and file access across the tenant, but it isn't always enabled by default depending on licensing tier and tenant age, and even when it is, almost nobody reviews it unless an incident has already happened. Without it, a security investigation after a suspected compromise has no record to work from. The account may have to be reset and re-secured based on guesswork rather than evidence of what an attacker actually did.

The fix is confirming audit logging is enabled tenant-wide, extending retention beyond Microsoft's default window where the license tier allows it, and routing a small set of high-risk events, new forwarding rules, new admin role assignments, and mass file downloads, to an alert that reaches a person, not just a log nobody opens.

What These Gaps Actually Cost When One Gets Exploited

IBM's 2025 Cost of a Data Breach Report puts the average cost of a breach where compromised credentials were the initial entry point at $4.67 million, with an average of 246 days to identify and contain the intrusion. Few companies in the 25 to 200 employee range will face a loss at that scale directly, but the ratio holds at smaller size too: the cost of a compromised admin account, in fraud losses, incident response, client notification, and lost trust, is consistently larger than the cost of the handful of Conditional Access policies and access reviews that would have prevented it.

The following summarizes the six mistakes covered above alongside what each one actually looks like in a tenant and the specific setting that fixes it.

Mistake	What It Looks Like	Fix
Legacy authentication enabled	POP3/IMAP/SMTP AUTH still allowed tenant-wide	Block via Conditional Access, test in report-only first
Weak admin protection	Admins use SMS or no MFA at all	Phishing-resistant MFA plus just-in-time elevation
Unmonitored forwarding rules	External auto-forward rules created silently	Block external auto-forward, alert on new rules
Default external sharing	"Anyone with the link" with no expiration	Restrict to approved domains, add link expiration
Audit logging off or ignored	No record of admin actions or sign-ins	Enable tenant-wide, route key events to an alert
Stale guest accounts	Years of accumulated, unreviewed guest access	Quarterly guest account review and removal

A Practical Quarterly Review Checklist

1. Confirm legacy authentication is blocked tenant-wide through Conditional Access, not just disabled for new users.
2. Verify every user with a Global Administrator role actually needs standing access, and move occasional admins to just-in-time elevation.
3. Require phishing-resistant MFA on every administrator account, with no exceptions for convenience.
4. Pull a report of all mailbox forwarding rules created in the last 90 days and confirm each one is legitimate.
5. Review external sharing links older than 90 days and remove or expire any that are no longer needed.
6. Confirm unified audit logging is active and that high-risk events are routed to a person who will act on them.

None of these six changes requires new software spend. They require someone with the authority and the calendar time to own the tenant configuration on a recurring basis, which is exactly the role that tends to fall through the cracks in a growth-stage company without a dedicated IT leader.

Frequently Asked Questions

How much does it cost to fix these Microsoft 365 configuration gaps?

Most of the fixes described here use licensing and Conditional Access features the organization is likely already paying for; the cost is time, not new tools. A structured review typically takes a few hours per quarter once the initial cleanup is done. The larger cost is the one avoided: IBM's 2025 data puts the average breach involving compromised credentials at $4.67 million, a figure that dwarfs the hours needed to close these gaps.

Do we need to buy a premium Microsoft 365 license to fix this?

Some capabilities, like Azure AD Privileged Identity Management and extended audit log retention, require Microsoft 365 E5 or an Azure AD Premium P2 add-on. Most of the highest-impact fixes, blocking legacy authentication, requiring MFA, restricting external sharing, and enabling baseline audit logging, are available on the licenses most growing companies already hold.

How does this work alongside our existing IT provider or internal IT staff?

This kind of tenant review is a natural extension of fractional IT leadership rather than a replacement for the team keeping day-to-day operations running. An existing managed service provider or internal IT staff typically handles help desk tickets, patching, and day-to-day support, but rarely has the mandate or the time to run a structured quarterly security configuration review on top of that workload. Elevaire's role is to set that review cadence, define the policies, and make sure someone is actually accountable for tenant configuration, working alongside whoever already manages daily IT operations.

How do we know if our tenant already has these problems?

Microsoft's own Secure Score, visible in the Microsoft 365 Defender portal, flags several of these issues directly, including legacy authentication status and MFA coverage on admin accounts. It doesn't catch everything, particularly forwarding rule abuse and stale guest access, which require a manual review or a scripted audit. A one-time configuration review is usually enough to establish a full picture before setting up recurring checks.

What's the first thing we should fix if we can only do one?

Blocking legacy authentication through Conditional Access. It's the single highest-impact change because it closes a gap that MFA cannot close on its own, and CISA's federal secure configuration baseline for Microsoft 365 identifies it as the top-priority control for exactly that reason.

How do we get started?

Start with a read-only review of the current tenant configuration against the six items in the checklist above, which requires no changes and no downtime. From there, legacy authentication and admin MFA are usually the two highest-priority fixes to schedule first, since they close the widest exposure for the least operational disruption.