Identity Is the New Perimeter: Microsoft 365 Controls Internal Teams Often Miss

In a cloud-first business, the firewall isn’t really the front door any more. The front door is your users’ sign-ins.

Attackers know this only too well. Rather than trying to break through the network, they phish passwords, trick people into approving app permissions, take over mailboxes and quietly set up forwarding rules. Once they can sign in as one of your users, a lot of your other security measures stop mattering.

In our recent post, Microsoft 365 is Not Secure by Default: 10 Settings Every SME Should Review Today, we covered the basics every organisation should check. This time, we’re going a step further and focusing on the identity controls that busy internal teams most often miss, even when the fundamentals are in place.

Here are eight worth looking at:

1. Conditional Access policies that have drifted

Most organisations have some Conditional Access policies. Far fewer have a set that still reflects how the business actually works. Exclusions added for one person or one project and never removed, policies left in report-only mode, no rule blocking legacy authentication, and no stronger requirements for admins or risky sign-ins – these are all common. Review your policies as a set rather than one by one, and make sure every exclusion has a documented reason.

2. MFA that can still be phished

Multi-factor authentication is essential, but not all MFA is equally strong. Simple push approvals and text message codes can be beaten by “MFA fatigue” attacks, where users are bombarded with prompts until they tap approve, and by phishing sites that relay codes in real time. Number matching should be the minimum, and privileged users should be moving towards phishing-resistant methods such as passkeys or FIDO2 security keys.

3. Standing administrator access

Global Administrator rights often end up held permanently by more people than necessary, sometimes including former suppliers. Cut the number of global admins right down, use least-privilege roles for everyday tasks, and where your licensing allows, use Privileged Identity Management so elevated access has to be requested, approved and expires automatically.

4. Third-party apps with too much access

This is one of the most overlooked risks we come across. In many tenants, users can grant a third-party app access to their mail, files or calendar with a single click. Some of those apps are perfectly legitimate. Some definitely aren’t. Restrict user consent, require admin approval for new apps, and review what already has access. When we rolled out managed security for Newmarket Holidays, our SOC flagged a potentially risky app connected to their Microsoft 365 environment within days of monitoring going live. It had been there long before anyone was looking.

5. Mailbox rules and forwarding

After taking over an account, attackers often create inbox rules that hide or forward messages, particularly anything mentioning invoices or payments. Block automatic forwarding to external addresses by default and keep an eye out for suspicious new rules.

6. Guest accounts that never go away

Guest accounts build up quietly over time and are rarely reviewed. Combined with generous sharing settings, they can expose far more information than anyone intended. Set sensible defaults, add expiry dates to guest access, and run regular reviews to remove people who no longer need to be there.

7. Risky sign-ins that nobody reviews

Microsoft 365 can flag impossible travel, unfamiliar locations and leaked credentials. But detection only helps if somebody acts on it. Make sure identity risk alerts go to people who review them around the clock, and have the authority to block a session or reset an account.

8. Baseline drift

Even a well-configured tenant drifts over time. New features arrive with default settings, emergency changes never get reversed, and administrators come and go. Measure your configuration against a recognised standard such as the CIS Microsoft 365 Foundations Benchmark, and do it regularly rather than once.

Making changes without upsetting everyone

Identity changes affect every user, so roll them out carefully. Start policies in report-only mode and check the impact before enforcing them. Pilot with the IT team and a small group of users first, tell people what’s changing before it happens, and keep protected, monitored break-glass accounts in case something locks everyone out. Agree beforehand who approves changes and how problems will be escalated.

How secure are your Microsoft 365 sign-ins?

Internal teams usually know these controls matter. What they’re often short of is time to review them regularly, and somebody watching identity signals outside office hours. 

Here at Reliable, we provide periodic baseline reviews and 24/7 identity monitoring that work alongside your internal team, so you keep ownership of policy and approvals. Our complimentary Security & Resilience Review includes a Microsoft 365 security posture discussion and an identity and privileged-access review, followed by a short summary of what to prioritise. It’s an introductory review rather than a full technical audit.

Lock the front door properly, and the rest of your security has a much better chance of doing its job.