The 7 Microsoft 365 Misconfigurations Behind Most SME Breaches

Why do configuration failures cause most SME breaches?

Microsoft 365 is a mature, well-engineered platform. The breaches rarely come from platform flaws — they come from tenants deployed with defaults built for accessibility, not protection. The security controls exist, but they have to be switched on deliberately. Almost no self-managed tenant does that.

In AMVIA's tenant audits the same gaps surface again and again, across every sector and size band. They are not edge cases — they are the norm for self-managed or lightly managed Microsoft 365. The UK Government's Cyber Security Breaches Survey 2025 again found phishing and compromised accounts the dominant attack route for SMEs — exactly what these misconfigurations leave open. Hardening a tenant is the single highest-return security action most SMEs can take, and it is the foundation of our Microsoft 365 security service.

The seven at a glance

Misconfiguration 1: MFA not enforced

This is the most common and most consequential gap. Multi-Factor Authentication (a second login factor beyond the password) blocks over 99% of account compromise attacks, according to Microsoft. Without it, a stolen or guessed password is all an attacker needs.

From one compromised account an attacker can read email, exfiltrate files, send phishing from a trusted address, and pivot to colleagues. The NCSC treats MFA as a baseline control for exactly this reason.

The fix: Enable Security Defaults in Microsoft Entra ID (free on all paid plans) to enforce MFA for everyone. On Business Premium and Enterprise, replace Security Defaults with Conditional Access policies for granular control. Enforce the Microsoft Authenticator app over SMS — it is more phishing-resistant. Our MFA setup for Microsoft 365 covers the rollout end to end.

Misconfiguration 2: Legacy authentication not blocked

Legacy authentication protocols — Basic Auth over IMAP, POP3, and SMTP AUTH without modern authentication — bypass MFA entirely. If credentials are stolen and legacy auth is enabled, an attacker authenticates with just the password and no MFA prompt ever fires.

Microsoft has been phasing legacy auth out for years, yet many tenants still allow it — typically for shared mailboxes, service accounts, or older email clients. Microsoft's guidance is to block it tenant-wide.

The fix: Create a Conditional Access policy that blocks legacy authentication. Before you apply it, review the Entra sign-in activity report to find which accounts still connect via legacy protocols, then update or replace those clients first. Done in the wrong order, this breaks a mailbox; done right, it closes one of the widest holes in the tenant.

Misconfiguration 3: Global Admin accounts overexposed

Global Administrator accounts have unrestricted access to the entire tenant. Many businesses run their everyday account as a Global Admin — the same account used to read email, browse the web, and occasionally click a phishing link. That single account becomes the keys to everything.

If that everyday account is compromised, the attacker inherits Global Admin: they can create accounts, assign licences, delete data, disable security controls, and exfiltrate the whole tenant.

The fix: Create dedicated admin accounts separate from daily-use ones, apply MFA strictly to every admin role, and minimise the number of Global Admins — most tasks run fine under scoped roles such as Exchange Admin or SharePoint Admin. On Business Premium and E5, use Privileged Identity Management (PIM) for just-in-time elevation so standing admin rights effectively disappear.

Misconfiguration 4: External sharing too permissive

Microsoft 365 lets users share SharePoint files and Teams content with external parties via anonymous links — URLs anyone can open without signing in. Convenient, and dangerous: links get forwarded, stored in inboxes, and discovered by bots scanning cloud storage. A single over-shared folder can leak years of data.

The fix: Review external sharing in the SharePoint Admin Centre. For most businesses, restricting sharing to authenticated external users — who must verify identity to open shared content — cuts exposure sharply. Set expiry on any anonymous links that genuinely must exist, and audit existing sharing activity periodically rather than once.

Misconfiguration 5: Inactive accounts not disabled

When staff leave, their accounts are routinely left active — sometimes for months. An active account belonging to a former employee is a persistent entry point. If those credentials were ever phished, shared, or sit on an old device, the account stays fully usable long after the person has gone.

The fix: Build an offboarding process that, on the leaver's last day, disables the account, revokes all active sessions (Entra ID → Users → Sign-in sessions → Revoke), and transfers data ownership to their manager. Set a reminder to permanently delete the account once the retention period passes, so dormant licences and data do not accumulate.

Misconfiguration 6: SPF, DKIM and DMARC not configured

Email authentication records stop attackers spoofing your domain — sending mail that appears to come from your company to your clients, suppliers, and staff. Without DMARC enforcement, anyone can impersonate yourcompany.co.uk. This is the engine behind most Business Email Compromise fraud.

SPF and DKIM are often partly configured during initial setup. DMARC — the enforcement and reporting layer — is the component most consistently missing.

The fix: Check current records with a tool like MXToolbox. Implement DMARC in monitoring mode first (p=none with reporting addresses) to see what legitimately sends on your domain, then move to quarantine and reject. Enable DKIM from the Microsoft Defender portal per Microsoft's instructions. Done correctly it takes a few hours and ends domain spoofing.

Misconfiguration 7: No backup

Microsoft 365 is not a backup. Recycle bins, version history, and retention policies give limited protection against accidental bulk deletion, deliberate destruction by a departing employee, or ransomware that encrypts files faster than version history captures clean states.

Businesses that learn this only when they need data from three months ago are in a hard place — sometimes an unrecoverable one.

The fix: Deploy a third-party Microsoft 365 backup covering Exchange, SharePoint, OneDrive, and Teams. AMVIA includes automated daily backup in our Microsoft 365 backup service; the cost is a fraction of a single recovery incident.

What ties all seven together?

Every one of these is preventable, and none needs advanced skill to fix — they need someone to know they exist and to spend the time. Businesses deploying Microsoft 365 themselves focus on getting the apps working, not on hardening the configuration, so the gaps persist quietly until something exploits them.

This is where a single accountable provider matters: one team that runs your tenant, watches it, and owns the outcome. AMVIA hardens all seven controls as part of managed IT support, backed by Microsoft Defender for Business and our in-house monitoring. We are a Microsoft Solutions Partner trusted by 1,200+ UK businesses, rated 4.8/5. One provider. Security-first. Microsoft-certified.