Office 365 security catches businesses out in a very particular way. Nothing looks broken. Mail flows, files sync, nobody complains — and the assumption quietly forms that Microsoft is handling it. Then something goes wrong, and the gap between what Microsoft protects and what you are responsible for turns out to be much wider than anyone realised.
This is not a criticism of Microsoft. The split in Office 365 security is published, deliberate, and reasonable. It is just that almost nobody reads it. Here is where it actually bites.
The shared responsibility model, in plain English
Microsoft operates what it calls a shared responsibility model. Roughly:
| Microsoft is responsible for | You are responsible for |
|---|---|
| Physical datacentres and hardware | Your data, and recovering it |
| The platform running and staying available | Who has access to it, and how |
| Infrastructure-level security and patching | How the tenant is configured |
| Baseline spam and malware filtering | Device security and user behaviour |
Read the right-hand column again. Every item on it is an Office 365 security decision for your business, not a Microsoft feature. That is the whole problem in one table.
Gap 1 — Microsoft does not back up your data
This is the one that costs real money, and the misunderstanding is nearly universal.
Microsoft guarantees the service will be available. It does not guarantee your content is recoverable. Retention policies, version history and the recycle bin are not backup — they are convenience features with time limits, and they can be defeated by exactly the events you need protection from:
- Ransomware encrypting files that then sync to SharePoint and OneDrive
- A departing employee deleting a mailbox’s contents on the way out
- An admin error that propagates before anyone notices
- Simple time — retention expires, and so does your ability to go back
A genuine Microsoft 365 backup is a separate product with its own retention under your control. It is inexpensive and it is the single highest-value thing most businesses are missing.
Gap 2 — MFA on admins is not MFA on your business
Microsoft now enforces multi-factor authentication for sign-ins to the Microsoft 365 admin centre. Good — but read what it covers. It protects administrative portal access. It does not switch on MFA for your ordinary staff, and your ordinary staff are who get phished.
Two things worth checking this week:
- Is MFA actually enforced for every user? Not “available”. Enforced, with no legacy exclusions quietly left in place.
- Is it phishing-resistant? SMS and approve-this-prompt notifications are both bypassable — SMS by SIM swap, push prompts by MFA fatigue, where an attacker fires requests at 3am until someone taps approve. Number matching and authenticator apps are materially stronger.
Beyond on-or-off, conditional access is where the real control sits: rules that evaluate who is signing in, from where, on what device. Blocking sign-ins from countries you do not operate in takes minutes and removes a large slice of automated attack traffic. This is included in the business plans most SMEs already pay for, and routinely goes unused — which is a good reason to have someone check what your Microsoft 365 subscription already entitles you to.
Gap 3 — Built-in email filtering stops the mass attacks, not the targeted one
Exchange Online Protection is good at volume: known-bad senders, known malware, obvious spam. What it is weaker against is the email specifically written for your business.
That is business email compromise, and it does not look like an attack. It is a plausible message from a supplier whose mailbox was genuinely compromised, asking you to update bank details on a real invoice. No malicious attachment, no dodgy link — nothing for a filter to catch. AI-generated phishing has removed the spelling mistakes that used to give it away.
Closing this needs two things working together: stronger email security with properly configured SPF, DKIM and DMARC, and security awareness training so people are comfortable questioning a payment request. The technical control alone cannot stop someone being persuaded.
Gap 4 — Nothing is watching the tenant
Microsoft 365 logs a great deal about your Office 365 security. For most small businesses, nobody is reading any of it.
A compromised account rarely announces itself. It quietly adds a mailbox forwarding rule, registers an extra MFA method, and waits. Weeks can pass before a payment goes to the wrong account. The signals were all there, sitting in an audit log nobody opened.
Alerting on the handful of things that genuinely matter — new forwarding rules, impossible-travel sign-ins, a new MFA method on an existing account, mass file downloads — turns an invisible compromise into a phone call. That is the core of managed cybersecurity, and it is also where configuration drift gets caught: tenants are rarely insecure on day one, they drift there over two years of small changes nobody logged. A periodic IT audit catches that.
What good Office 365 security looks like
None of this is expensive. Most of it is already in your licence:
- MFA enforced for every user, phishing-resistant, with no legacy exclusions
- Conditional access restricting sign-ins by location and device health
- A real third-party backup of Exchange, SharePoint, OneDrive and Teams
- SPF, DKIM and DMARC correctly published and actually enforcing
- Audit logging on, with alerts on forwarding rules and MFA changes
- Admin accounts separate from day-to-day accounts
- Legacy authentication protocols switched off
- Company data controlled on phones and laptops through mobile device management
For the step-by-step version of this, our free guide to Microsoft 365 security in 10 essential steps walks through each control in non-technical language. Cyber Essentials certification covers much of the same ground and gives you something to show customers.
How Cyber Kaizen helps
As a Microsoft Partner we review tenants for businesses of 10 to 200 staff, and the findings are consistent: licences already paying for controls that were never switched on.
Through Microsoft Modern Workplace deployments we apply security baselines as standard rather than as an afterthought, and for clients on managed IT support the monitoring, backup and configuration review are simply part of the service. If you are a smaller business without in-house IT, that is usually the most economical route to a tenant that is actually configured properly.
Frequently asked questions
Is Office 365 secure by default?
Partly. Office 365 security is shared: Microsoft secures the platform and provides baseline spam and malware filtering, but tenant configuration, user access, device security and data recovery are your responsibility under the shared responsibility model. The defaults are a starting point, not a finished configuration.
Does Microsoft back up Office 365 data?
No. Microsoft guarantees service availability, not recovery of your content. Retention policies, version history and recycle bins have time limits and will not reliably protect you from ransomware, malicious deletion or admin error. A separate Microsoft 365 backup is needed.
Is MFA now mandatory for Microsoft 365?
Microsoft enforces MFA for sign-ins to the Microsoft 365 admin centre. That covers administrative portal access only — it does not enable MFA for your ordinary users, which has to be configured separately and should be treated as essential.
What is conditional access and do I already have it?
Conditional access applies rules to sign-ins based on user, location, device and risk — for example blocking access from countries you do not operate in. It is included in most Microsoft 365 Business Premium and Enterprise plans, and is very commonly paid for but never configured.
Will Office 365 stop phishing emails?
It stops most high-volume phishing and known malware. It is far less effective against targeted business email compromise, where a legitimate but compromised account sends a plausible request with no attachment or link for a filter to flag. That needs email authentication plus user training.
What is the most common Office 365 security gap?
The absence of a real backup, followed closely by MFA that is available but not enforced for every user. Both are inexpensive to fix and both are routinely assumed to be handled already.
Find out what your tenant is actually doing
Most businesses have never had anyone look at their Office 365 security configuration since the day it was set up. It is usually a short conversation with a few surprises in it.
Book your free IT health check and we will review your tenant against the controls above and tell you which ones your licence already covers. Or get in touch if you have a specific concern.
Related reading: Are VPNs dead? The new era of Microsoft Global Secure Access.
Sources: Microsoft Learn — shared responsibility and Microsoft 365 architecture; National Cyber Security Centre.
