You’ve moved to Microsoft 365. It’s easy to think security is now taken care of - Microsoft is a global tech leader, their tools are strong, and security features are included as standard. But in reality, the primary purpose of those tools is to secure Microsoft’s platform.
Your tenant, your staff, your data - all of this is a separate job. And it’s a job that most SMEs don’t realise falls to them. This means the gaps we’ll cover below often go unnoticed until some security breach brings them suddenly into focus.
In this guide we’ll run you through five gaps that SMEs frequently miss when securing their Microsoft 365 environment. We’ll also show you what good looks like, along with a checklist you can use to see how your business security is looking.
Here’s what we’ll cover:
- The key assumption worth checking (“we’re on Microsoft 365, so we’re covered!”)
- What Microsoft secures vs what it leaves to you
- Five Microsoft 365 security gaps that most SMEs miss
- What good looks like for a business with 20-100 users
- A 6-question self check to see how exposed your business is
- A client story to put everything in context
“We’re on Microsoft 365, so We’re Covered!” - the Key Assumption Worth Checking
Head to the Microsoft 365 for Business website and you’ll see it billed as “the tools you need … including custom-branded email, professional apps, advanced security, and scalable admin controls.”
There’s a tab called “Scale Securely” in the product features, too, with a video showcasing features like:
- Automatic protection from threats
- The tools to secure your data
- Easy controls over data safekeeping
- Password protection and permission settings
So it’s a reasonable assumption that security is built in. And it is, to an extent - but the crucial distinction is this: security in Microsoft 365 is shared. Microsoft secures some things by default, and you are responsible for the rest.
SMEs who work on the assumption that Microsoft secures everything out of the box, with no additional security required by them, risk leaving the exact gaps attackers look for - unenforced logins, unfiltered email, unrecoverable data.
What Does Microsoft Secure, and What’s Left to You?
The short answer to this question: Microsoft keeps the Microsoft 365 platform running, but keeping your business secure on it comes down to you (or, your Microsoft 365 management partner).
For a more detailed breakdown of your and Microsoft’s respective responsibilities, see the table below.
What Microsoft Handles |
What Falls to You |
|
The physical security of its data centres: the buildings, servers and networks your data sits on are protected to a standard no SME could realistically match. |
Identity and access: who can sign in, from where, with what proof. Unenforced sign in is the most common vulnerability attackers exploit. |
|
Platform uptime and resilience: Microsoft keeps the service running and available, with enough redundancy to handle hardware outages and failures. |
Configuration of security controls provided: the tools are there but they need to be turned on and configured. Default settings don’t necessarily offer the best protection. |
|
Service-level patching of the platform: Microsoft updates and patches the underlying platform so the core service stays protected against known flaws. |
Data protection and retention: recovering emails and files after deletion isn’t something Microsoft can do for you, a very common misconception. |
|
Making security tools like MFA and security controls available: the controls you need are there, but as we’ll cover, they’re not necessarily switched on or configured. |
User behaviour: staff click links, use passwords across different platforms, share files - all potential vulnerabilities if your security settings aren’t configured properly. |
Five Microsoft 365 Security Gaps that Most SMEs Miss
We’ve helped over [for PCSG: number] businesses manage and secure their 365 platform. In that time we’ve seen the same gaps come up frequently. The five we see most often are outlined below, along with their potential impact on SMEs.
We’ve also closed these gaps each time we’ve encountered them, delivering tighter, more secure Microsoft 365 environments for our clients. If this is something you want for your organisation, get in touch with our team or request a free consultation now.
SME Security Gap 1: MFA is Switched On but Not Enforced
MFA - Multi-factor authentication - is a second check at sign in, often a prompt or code, so that an attacker can’t get in with a stolen password. Having it enabled is one of the single most effective steps you can take to protect against hacked accounts.
The issue: we commonly find MFA enabled for some users, skipped for admins, or set up with no conditional access.
Why this is a risk: access gaps are easy vulnerabilities for attackers to target: gaining access to an unprotected admin account gives access to the whole tenant, meaning every mailbox and file is within their reach.
How to fix it: enable MFA for everyone, including admins. Require conditional access (trusted people, trusted places and devices).
SME Security Gap 2: Email Filtering Stops at Microsoft’s Defaults
The defaults protect against spam and obvious malware, but less so against targeted phishing, impersonation, and business email compromise - these are messages carefully crafted to look like a supplier, colleague, or even boss.
The issue: we often find settings left at Microsoft’s defaults.
Why this is a risk: sophisticated phishing can cost SMEs huge amounts of money, and they slip past default settings because there’s no malware to catch.
How to fix it: layering intelligent phishing and impersonation detection on top of default settings - protection reads context and intent, flags spoofed senders, and catches targeted messages that the baseline settings might otherwise miss.
SME Security Gap 3: Your Microsoft 365 Data Isn’t Backed Up
It’s easy to think that because your data lives in the cloud, it’s safe. But Microsoft only replicates your data for availability, rather than backing it up in a way that lets you roll back to a previous state.
The issue: businesses often think that more of their data is backed up than actually is.
Why this is a risk: data that you think is backed up could be gone forever once Microsoft’s retention window password. Whether it’s deleted by accident, wiped when a license is removed, or encrypted by ransomware.
How to fix it: put an independent point-in-time backup in place across OneDrive, Teams, SharePoint so that anything lost - an email, an entire directory - can be easily restored.
SME Security Gap 4: No One is Watching the Dark Web for Your Credentials
When any company or website is breached, stolen usernames and passwords often end up on the dark web.
The issue: staff often reuse passwords, meaning that a stolen login for a completely different site can compromise your organisational security.
Why this is a risk: if a malicious actor uses real credentials to log in to your organisation's network, it looks like a normal login rather than an attack. They can do huge amounts of damage before the incursion is even noticed.
How to fix it: set up dark-web monitoring to watch for your company’s credentials showing up on the dark web, and enact regular password changes to protect against stolen credentials being used to log in.
SME Security Gap 5: You Can’t See Your Own External Attack Surface
Your external attack surface is anything related to your business that’s accessible from the internet. Think login pages, old accounts, misconfigured settings and so on. Each of these is a potential vulnerability that an attacker could use to get access.
The issue: most SMEs we work with have little to no idea about what’s actually exposed.
Why this is a risk: you can’t protect what you don’t know is there, and attackers are very good at identifying, scanning for, and taking advantage of weak points.
How to fix it: external attack surface monitoring continuously scans what your organisation exposes to the internet, so gaps are found and closed before they’re exploited.
What Good Looks Like for a Business with 20-100 Users
The ideal situation is for Microsoft 365 security to not be an ongoing worry, and this is achieved by having the right security layer in place and keeping it current. For a business of 20–100 users, here’s what that looks like:
Identity and access
- MFA enforced for every user, including admins: this means a stolen or guessed password on its own is never enough to get in
- Conditional access: sign-ins are checked against location, device and risk, keeping access to trusted people in trusted circumstances
- Least-privilege admin rights: only users who genuinely need admin access have it
Email and data
- Layered email security beyond the Microsoft default: intelligent phishing and impersonation detection to catch targeted, malware-free scams
- Independent, point-in-time Microsoft 365 backup: across Exchange, SharePoint, OneDrive and Teams, so deleted or ransomed data can be restored in minutes
- Full-disk encryption on every device: lost or stolen laptops become an inconvenience, not a data breach
Devices and endpoints
- Modern endpoint protection (not just traditional antivirus): behaviour-based defence that spots and stops the threats missed by legacy AV
- Managed patching of operating systems and applications: unpatched software is one of the most common ways in
- Managed web filtering: to block access to malicious and high-risk sites before they cause a problem
Visibility
- Dark-web credential monitoring: alerts you when company logins appear in breach data, so passwords are changed before anyone uses them
- External attack-surface monitoring: continuous visibility of what you expose to the internet, so gaps are found and closed proactively
People and governance
- Ongoing security-awareness training: turns your staff from the targeted weak points into a line of defence
- Cyber Essentials certification: an independent benchmark that proves the basics are covered
- Continuous monitoring, with a named person accountable: someone actively watching, maintaining and reviewing all of the above
This is a big list, but it doesn’t require an in-house security team. It requires a Microsoft 365 security partner to build and actively manage the right setup.
How Exposed Are You? A 6-Question Self-Check
It can be hard to know what your organisation’s risk profile looks like. If you’ve got concerns about your Microsoft 365 security, the questions below will help you to get a feel for where you’re at:
- Is MFA enforced for every user, including admins?
- Do you have conditional access (restrictions by location/device) or just MFA?
- If a member of staff deleted a shared SharePoint mailbox today, could you recover it in 30 days?
- Would you know if a company password appeared in a dark web data dump?
- Is your email protection more than Microsoft’s default filter?
- Do you know which organisation assets are currently exposed on the internet?
Answered no to any of these, or don’t know the answers? These are the gaps this piece is about, and are signs that your security might not be as good as you think.
The good news? The gaps are closable.
Close Your Microsoft 365 Security Gaps Without Becoming an IT Expert
Microsoft 365 is an incredibly powerful platform that delivers countless benefits for SMEs. Used properly it is secure, but not every organisation has the knowledge or resource to properly configure their Microsoft 365 security - leaving dangerous vulnerabilities.
Identifying and fixing security gaps doesn’t require creating an in-house security team or becoming an expert yourself. It just needs the right managed layer put in place, and someone to be accountable for it.
To find out how secure your Microsoft 365 configuration is, book a free consultation today. Our team of experts will audit your site and send you a no obligation report of your vulnerabilities and opportunities.