Most Microsoft 365 incidents we hear about from partners don’t start with a zero-day. They start with a default setting nobody changed, a forwarding rule nobody noticed, or an app permission nobody reviewed. The tenant was never attacked in a clever way — it was just left open.
For MSPs, this is actually good news. These are fixable problems, and fixing them is a service you can sell, not just a favour you do for free during onboarding.
Identity is the real perimeter now
There’s no office network boundary to defend in most Microsoft 365 tenants. The perimeter is the identity layer — usernames, passwords, and whatever sits between a stolen credential and someone’s inbox.
The single highest-value thing you can do for a client is make sure multi-factor authentication is enforced for every account, including service accounts and shared mailboxes that often get quietly excluded. Attackers specifically look for the accounts that were exempted because they were inconvenient to protect.
Conditional access policies take this further by letting you restrict sign-ins by location, device compliance, or risk signal. Many clients already pay for licensing that includes this capability and simply aren’t using it.
Default settings aren’t security settings
Microsoft 365 ships with sensible defaults for getting work done, not for locking things down. Left alone, many tenants allow external sharing on every SharePoint site, let any user create a Team or a public group, and permit forwarding to external addresses without a second look.
None of this is a bug. It’s a productivity-first default that assumes someone will come along later and tighten it for the organisation’s actual risk tolerance. In practice, that someone is rarely anyone, unless it’s written into your onboarding checklist.
Walking a new client through sharing defaults, group creation permissions, and guest access settings takes an afternoon and closes off a surprising number of easy paths into the tenant.
Mailbox rules nobody checks
A compromised account rarely announces itself. Attackers who get into a mailbox often set up a quiet forwarding rule to an external address, then sit and read invoices and contracts until they spot an opportunity for fraud — usually a payment redirect.
These rules are easy to create and easy to miss, because nobody is in the habit of auditing mailbox rules across a tenant unless something has already gone wrong. Building a regular review of inbox rules and forwarding settings into your standard monitoring catches this before it turns into a wire fraud case your client calls you about afterward.
Third-party app permissions pile up quietly
Every time a user clicks