Assessing security controls for Microsoft 365 Enterprise

Much like many cloud services, Microsoft 365 Enterprise’s core value proposition becomes its primary challenge for security teams. The cloud-based suite of productivity apps and services (formerly Office 365) lets companies create, share and collaborate from anywhere on any device. Even if an enterprise does not operate on Microsoft 365, no doubt a large percentage of its business partners are, especially with the increased need for remote collaboration during the pandemic.

While Microsoft 365 offers an expansive set of capabilities, the core security controls boil down to a pretty short set of essentials, achieved through Microsoft’s unified identity and access management architecture. While it’s a short control list, security pros need to get the configurations right. Microsoft 365’s default configurations are pretty promiscuous. These default settings include letting non-privileged users invite guest users to the organization’s Azure Active Directory and default file sharing settings.