Microsoft 365: Your Data Is in the Cloud, but Who Can Actually Reach It?

For many businesses, Microsoft 365 is no longer just an email system. It is the workplace.

• Outlook holds business communication.
• Teams holds meetings and conversations.
• OneDrive holds users' files.
• SharePoint holds organizational knowledge and documents.
• Entra ID manages a central part of identities and access.

In other words, when we talk about Microsoft 365 security, we are really talking about a very significant part of the business.

"It's at Microsoft" does not answer the security question

Microsoft invests enormous resources in securing its infrastructure. But there is an important distinction between the security of the platform and the way the organization uses it:

• Who can sign in, and under what conditions?
• What information can they see?
• What can they share?
• What happens when they change roles?
• Which accounts hold admin permissions?

These decisions sit largely on the organization's side.

Identity has become the new line of defense

In the past, organizations thought mainly in terms of "the internal network". If you were in the office, you were inside. If you were on the internet, you were outside.

The cloud changed that model. Employees connect from home, from phones and laptops, vendors connect from outside, and people work while traveling. There is not always a clear physical boundary. That is why the user's identity has become one of the most important factors in deciding who gets access.

A mailbox is sometimes a key to the organization

If an attacker manages to take over a user account, they may get much more than access to email. They can see contacts, documents, Teams conversations, internal links and information about customers and vendors.

In some cases they can use the account to continue the attack from an identity the organization already knows and trusts. That is why MFA matters, but it is not the end of the story.

Permissions expand far more easily than they shrink

An employee starts in sales and gets permissions. Moves to another role and gets new permissions. Joins a project and gets additional access. Over the years it is almost always easier to grant access than to remember to remove it.

This is not necessarily negligence. It is a natural result of a dynamic organization. But when there is no orderly process for reviewing permissions, users can accumulate access that no longer relates to their role. We covered this in more detail in our article on employee access permissions.

What about SharePoint and OneDrive?

Sharing a document is very easy, and that is exactly the advantage. But:

• Do you know which documents are open to external links?
• Who has access to old SharePoint sites?
• What information was shared with vendors a year ago?
• Does access that was needed for a temporary project still exist?

Convenience is an important part of work, and good security should not destroy it. But it should make sure convenience does not turn into uncontrolled exposure.

One administrator can change the picture

Accounts with high privileges carry significant power, and therefore significant risk. It is not only the number of such accounts that matters, but also how they are managed and whether their use fits the need.

Separating everyday use from admin actions is one example of thinking that reduces risk without necessarily getting in the way of work.

Microsoft 365 is a business-critical system

That is why it is not enough to ask "is MFA enabled?". The broader question is: is your Microsoft 365 environment managed according to your organization's risk? A cyber risk assessment is a good way to answer it.

Microsoft 365 with Marom Cyber

Marom Cyber helps organizations review and harden their Microsoft 365 environment, looking at identities, permissions, access and data sharing. It is part of our information security and cyber advisory services.

Frequently asked questions