Microsoft 365 is not automatically secure. Here's what "properly set up" means.

There's a widespread and very expensive misunderstanding sitting in a lot of Australian small businesses: buying Microsoft 365 gives you secure Microsoft 365.

It doesn't. Microsoft 365 out of the box is a well-designed platform with sensible defaults. But "sensible defaults" and "properly configured for your business" aren't the same thing. Default settings are a starting point, not a finish line.

Where the default settings leave real gaps

• Sharing controls. Default sharing settings in SharePoint and OneDrive lean permissive. External sharing is often on. Guest access is often broader than you'd want.
• MFA coverage. Even where MFA is on for interactive logins, service accounts, shared mailboxes and legacy protocols can slip through.
• Conditional Access. Not configured by default. Meaning you can't enforce "only from managed devices" or "only from Australia."
• Audit logging. Enabled, but retention and export defaults are minimal.
• Anti-phishing tuning. Default rules are okay. Environment-specific tuning is far better.
• Sensitivity labels. Off by default. Not applied to anything.
• Backup. Not a Microsoft responsibility. See our separate article on that.

What "properly set up" looks like

• Conditional Access covering managed devices, geographic controls, and phishing-resistant sign-in.
• MFA universally enforced, including service accounts, shared inboxes, and guest access where possible.
• Sharing controls dialled to your risk appetite, with a clean set of exceptions rather than a permissive default.
• Audit logging turned up and retained.
• Sensitivity labels implemented for at least the categories that matter — client records, financials, HR.
• DKIM, DMARC and SPF properly configured so your outbound email doesn't get treated as suspicious, and inbound spoofing is harder.
• A regular review — usually quarterly — because Microsoft moves the platform, and what was configured six months ago isn't necessarily configured now.

Why this matters more than it sounds

Because insurers, larger clients and regulators all treat Microsoft 365 as "should be hardened by default." A breach that started with a permissive sharing setting or a missing Conditional Access rule doesn't get much sympathy — from anyone.

Where we start with new clients

Every managed client gets a Microsoft 365 tenant health check as part of onboarding. Not "here's a report you can go do something with" — a hardening pass we do with you.