Top 10 Microsoft 365 Security Misconfigurations: Full Guide to Fixing Common Risks Step-by-Step
- Hanna Korotka
- 1 day ago
- 3 min read
Microsoft 365 Security Misconfigurations are one of the most common causes of data breaches, ransomware infections, and compliance failures. Whether you're a small business, enterprise, or nonprofit, misconfigured settings can leave your organization exposed.
This step-by-step guide walks you through the top 10 misconfigurations we frequently encounter—and how to fix them to strengthen your security posture.
1. Missing Multi-Factor Authentication (MFA) for Admins
Why it matters: Admin accounts are high-value targets for attackers.
How to fix it:
Go to Microsoft Entra admin center.
Navigate to Conditional Access > Policies.
Create a new policy targeting admin roles: Under Assignments, select Users or workload identities.
Under Include, select Directory roles and choose at least the previously listed roles.
Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').
Set Grant access > Require multi-factor authentication.
Enable and test the policy.
2. Overly Permissive External Sharing Settings
Why it matters: Sensitive files can be accidentally exposed.
How to fix it:
Open Microsoft 365 Admin Center.
Go to SharePoint Admin Center > Policies > Sharing.
Set external sharing to any of these options:
- “Only people in your organization” (No external sharing allowed)
- "Existing guests" (Only guests already in your organization's directory)
- “New and existing guests” (Guests must sign in or provide a verification code.).
3. Disabled Audit Logging
Why it matters: Without logs, you can’t investigate suspicious activity.
How to fix it:
Go to Microsoft Purview compliance portal.
Navigate to Audit > Audit log search.
Click Start recording user and admin activity.
4. Unmonitored Mail Forwarding Rules
Why it matters: Attackers use forwarding to exfiltrate data silently.
How to fix it:
In the Microsoft Defender portal at https://security.microsoft.com
Go to Email & Collaboration > Policies & Rules > Threat policies > Anti-spam in the Policies section.
Select Anti-spam outbound policy (Default)
Scroll to the Automatic forwarding setting.
Set it to: Off (Forwarding is disabled)
Click Save to apply the changes.
5. Inactive Users with Access
Why it matters: Former employees may still have access to sensitive data.
How to fix it:
Review user activity in Microsoft Entra ID.
Disable or delete inactive accounts.
Reset their password.
6. Weak Password Policies
Why it matters: Simple passwords are easily guessed or brute-forced.
How to fix it:
Go to Microsoft Entra ID > Authentication methods > Password protection.
Enable custom banned password list.
Enforce strong password length and complexity.
7. Lack of Conditional Access Policies
Why it matters: Not all users should access data from all locations or devices.
How to fix it:
Go to Microsoft Entra admin center > Conditional Access.
Create policies to block access from untrusted locations or unmanaged devices.
Use sign-in risk detection to trigger MFA or block access.
8. No Data Loss Prevention (DLP) Policies
Why it matters: Sensitive data can leak via email, Teams, or cloud apps.
How to fix it:
Go to Microsoft Purview > Data Loss Prevention.
Create DLP policies for Exchange, SharePoint, OneDrive, and Teams.
Define sensitive info types (e.g., credit card, SSN).
Set actions like block, encrypt, or audit.
9. Unprotected Mobile Devices
Why it matters: BYOD introduces unmanaged risks.
How to fix it:
Use Microsoft Intune > App Protection Policies.
Require PIN, encryption, and wipe on sign-out.
Block access from jailbroken or rooted devices.
10. Ignoring Microsoft Secure Score
Why it matters: Secure Score offers actionable insights to improve security.
How to fix it:
Go to Microsoft 365 Defender portal > Secure Score.
Review your current score and recommendations.
Implement high-impact actions like MFA, DLP, and conditional access.
Track progress over time.
Fixing these Microsoft 365 Security Misconfigurations is essential for protecting your organization’s data, reputation, and compliance. This complete setup guide gives you the tools to act today.
Need help auditing your Microsoft 365 environment or implementing these fixes? Contact us for a free security assessment.