Six Microsoft 365 mistakes we find in almost every tenant
Microsoft 365 is configured once, usually in a hurry, and then inherited. These are the six problems we find nearly every time we take one over.
Laurent Lebihan · Lebtek
7 min read
How tenants end up this way
Almost nobody designs their Microsoft 365 tenant. It gets stood up quickly during a migration or a first hire, configured to the point where mail works, and then grows for years through individual decisions made under time pressure by whoever was available.
The result is remarkably consistent across companies. Six problems show up nearly every time.
1. Licensing has drifted
The most common and the easiest to fix. Licenses assigned to people who left. Premium licenses on users who need a basic plan. Two overlapping products bought at different times that duplicate the same function.
Nobody audits this because nobody owns it, and the amount is small enough monthly to escape notice while being significant annually. A license review usually pays for a quarter of the engagement that found it.
2. Multi-factor authentication is partial
Most tenants we inherit have MFA on some accounts. Executives have it. The service account running the scanner does not. The shared mailbox nobody thinks of as an account does not. A contractor from two years ago still has access and never had it.
Partial coverage provides the confidence of protection without the protection. Attackers do not test the hardened accounts; they test all of them and use whichever answers.
Credential theft does not require sophistication. It requires one account, anywhere in your tenant, without a second factor.
3. Offboarding is incomplete
When someone leaves, the usual action is disabling the sign-in. That is a start and not sufficient.
Active sessions can persist. Application-specific passwords keep working. Their personal device may still be enrolled with access to company data. Files in their personal storage — often the only copy of something a team needs — become inaccessible or get deleted on a schedule nobody set deliberately. Forwarding rules they created continue quietly forwarding.
Offboarding should be a written checklist, executed the same way each time, with someone accountable for it. Improvised departures are where long-term exposure accumulates.
4. Sharing links never expire
Sharing a file externally is one click and, by default, permanent. Over several years an organization accumulates thousands of live links to documents, held by former clients, former vendors, and former staff, in inboxes nobody controls.
None of it appears in a security report because nothing is technically wrong. Sensible defaults — expiry on external links, restrictions on anonymous access, periodic review of what is shared outside the company — cost nothing and are almost never configured.
5. There is no independent backup
This one is a genuine misconception rather than an oversight. Microsoft replicates your data across their infrastructure, which protects against their hardware failing. It does not protect you from your own actions.
A deleted mailbox past its retention window is gone. Ransomware that encrypts synced files syncs the encryption. A departing employee who clears their sent items has cleared them. Retention policies help within their configured window and are not a backup.
Independent backup with tested restores is a separate product and a separate control, and its absence is the single most common serious gap we find.
6. Devices are unmanaged
Company data reaches personal laptops and phones with no policy governing them. No requirement for disk encryption, no enforced screen lock, no ability to remove company data from a device that is lost or belongs to someone who left.
Device management is included in licensing many companies already hold, and it is frequently unconfigured because it was not needed on day one and nobody revisited it once the company grew past five people.
Fixing these in the right order
Do not attempt all six at once. The sequence that produces the most risk reduction per unit of disruption:
- MFA everywhere, including service and shared accounts.
- Independent backup, configured and restore-tested.
- A written offboarding checklist with an owner.
- External sharing defaults and a review of what is currently shared out.
- Device management policy, rolled out gradually.
- License audit — often last, because it is the one that funds the rest.
None of this requires new products in most cases. It requires deciding to configure what you are already paying for, and giving one person responsibility for keeping it that way.
This is the kind of work covered by our Cloud Solutions. Questions about your own environment? Call 480-999-9242 or send us a note.