Microsoft 365 management
Microsoft 365 security mistakes we see most often
Microsoft 365 is how most Southlake and Dallas–Fort Worth businesses email, share files, and hire people. It is also one of the easiest places for an attacker to walk in — not because Microsoft failed, but because the tenant was never finished.
Email, files, Teams, user accounts, and a large part of security now sit in one platform. That concentration is useful. It is also why a single compromised mailbox can open documents, shared mail, and the next invoice run.
A common misconception is that buying Microsoft 365 makes the company secure. Microsoft provides the tools. Someone still has to turn them on, watch them, and keep them current. Leaving defaults in place is not a strategy. It is a subscription.
Why this matters
Passwords leak. People reuse them. Phishing still works. If the only lock on email is a password, the rest of the tenant is one inbox away.
For a 15-to-250-person company, Microsoft 365 is usually the system of record for work. Controllers, office managers, and practice owners feel a tenant problem as payroll delay, a missing file, or a client who cannot be emailed — not as an “identity event.”
Cyber insurance questionnaires in this market now ask about MFA, admin access, and offboarding. “We have Microsoft 365” is not an answer. Cyber insurance readiness is what those questions look like when nobody has reviewed the tenant.
Common causes
It was set up as email, then everything else arrived
Teams, SharePoint, extra licenses, and a few security features were added as people asked. Nobody was paid to own the admin center.
Admin rights were the easy button
A consultant needed access. A project needed a permission. An executive wanted “just in case.” Years later, global admin is a crowd.
Offboarding never became a process
Hiring has a checklist. Leaving often does not. Licenses stay assigned. Shared mailboxes keep a former bookkeeper. Guests linger in Teams.
Licenses were purchased and never opened
Conditional Access, device management, and email protection sit on the bill. Defaults sit in the tenant. Paying for a feature is not the same as using it.
Business impact
- A stolen password without MFA is often enough to read mail, reset other passwords, and impersonate finance.
- Too many global admins means one compromised account can change security settings, not just a mailbox.
- Former employees with access are not a “what if.” They are a present login.
- Unmanaged phones and home PCs are how company files leave the building without anyone noticing a theft.
- Oversharing turns a convenient link into a document that still opens for people who left the project two years ago.
The mistakes we still walk into
1. Multi-factor authentication is not fully enforced
If we could recommend one change first, it would be MFA that is required — not offered. Optional enrollment is how executives and service accounts stay on passwords forever. Once a password is in a breach or a phishing kit, mail, files, and customer records are in play. MFA is a second check before that login succeeds.
- MFA is not on for every user
- Service accounts skip it
- New hires are not required to enroll
- Leadership has a weaker policy than everyone else
2. Too many global administrators
Global admin can change nearly everything in the tenant. Privileges accumulate because granting access is faster than restricting it. A former consultant, a one-time project, an executive “just in case” — years later nobody can list who actually controls Microsoft 365. One of those accounts compromised is not a mailbox incident. It is the environment.
- More than a few people have global admin
- Admin accounts are used for daily email
- No periodic access review
- Former vendors still have privileges
3. Former employees still have access
Most companies can onboard. Fewer can offboard. Active accounts turn up months after someone left — still in email, SharePoint, Teams, OneDrive, shared mailboxes, and files they should not see. Every leftover account is a login you are not watching.
- No written offboarding checklist
- Inactive accounts still exist
- Licenses still assigned to people who left
- Nobody reviews access on a calendar
4. Devices nobody manages
Work is no longer only the office PC. Laptops, phones, tablets, and home computers all open Microsoft 365. Without device standards you cannot answer whether the machine is encrypted, patched, or wipeable if it is stolen. Protecting the account is not the same as protecting the device that already downloaded the files.
- Personal devices open company data with no standard
- No device inventory
- Lost devices cannot be locked or wiped
- Security depends on who owns the laptop
5. Sharing that never got a review
Microsoft 365 makes collaboration easy. It also makes oversharing easy. Folders go external. Guests join Teams. Anonymous links never expire. Eventually nobody can say who can open the sensitive material.
- External sharing is wide open
- Guest accounts accumulate
- Anonymous links still work
- SharePoint and Teams permissions have never been reviewed
6. Security features on the invoice, still at default
Many plans include Conditional Access, device management, identity protection, data-loss controls, and email security. Owning them without turning them on is a security system that was never armed. Defaults are not a standard.
- Settings still at Microsoft defaults
- No written security standard for the tenant
- Features licensed and unused
- Nobody named as the administrator of record
Recommended solution
You do not need a perfect tenant. You need visibility and a short list: MFA everywhere it belongs, fewer global admins, former staff out, devices you can describe, sharing you can explain, and licensed features that are actually on.
If any of this is unfamiliar — who the admins are, whether MFA is required, whether personal devices are in play, whether old accounts exist, whether SharePoint is a maze, whether settings have been reviewed since setup, whether an insurer is asking — the tenant needs a review. That is normal. The goal is a plan, not a myth of perfection.
For businesses in Southlake and across DFW, Microsoft 365 management is how 323 Technologies takes that list off the owner’s desk.
How 323 Technologies helps
We do more than create users and reset passwords. We review how the tenant is actually configured, tighten identity, cut unnecessary admin, put onboarding and offboarding on a checklist, set a device standard, and put SharePoint and Teams on a pattern people can follow.
A few targeted changes usually move risk more than a rebuild. If you are unsure what is on, we will tell you — and what it costs for us to own it from Southlake.
Questions
Does Microsoft 365 include security if we already pay for it?
It includes tools. Defaults and unused licenses are not protection. Someone has to configure MFA, admin roles, sharing, and devices, then keep them that way.
Can we turn on MFA without disrupting the office?
Yes, with a rollout: announce it, enroll in waves, exempt nothing that is a person. Service accounts need a different pattern — not a blanket skip for executives.
How many global admins should we have?
As few named people as you can still operate with if one is out, using separate admin accounts — not daily email. Review the list on a schedule.
What about Microsoft backup?
Retention is not the same as a backup you can restore. If email and files are the business, ask what sits outside Microsoft’s recycle bins. That work lives with Cloud & Microsoft 365 as well as ongoing tenant management.
Is this the same as calling Microsoft support?
No. Microsoft can tell you if the service is up. They will not offboard your former bookkeeper or sit with you on a license bill. That is local administration.
We have a cyber insurance renewal. Where do we start?
MFA, admin accounts, offboarding, and whether backups restore. Those are the questions on the form. See cyber insurance readiness if the questionnaire is the deadline.
Next step
If you cannot describe who can get into Microsoft 365, start there.
Explore Microsoft 365 management — how 323 Technologies reviews security, access, and the monthly mess for businesses across Dallas–Fort Worth.
Or call (817) 477-6111