From email security to privileged access management to DevOps, Rob’s experience has led to his deep passion for solving the biggest challenges for IT and security teams across higher education, Fortune 1,000 companies, and more.
The biggest worries for global organizations are the things they are least prepared for. According to consultancy PwC’s 2025 Global Digital Trust Insights, only 2% of tech executives they surveyed had implemented cyber resilience across their organizations, while at the same time, 66% of tech leaders cite cyber risk as the top area for mitigation.
For organizations depending on Microsoft 365, adopting a strong Microsoft cyber resilience strategy builds layers of resilience directly into your tenant – letting you withstand attacks when they happen.
Cyber resilience in Microsoft 365 means preparing for missteps, not just attacks. This article lays out how to strengthen your tenant across key layers—identity, configuration, and collaboration—so your team can detect failures early, recover quickly, and keep operations moving. It covers practical strategies like enforcing least privilege, catching policy violations in real time, and rolling back risky changes before they spread. For IT and security leaders navigating privilege sprawl, misconfigurations, and Copilot exposure, this is a clear framework for building tenant-wide resilience before the next incident tests it.
Why is Cyber Resilience Important for Microsoft 365?
Microsoft 365 isn’t just an app. It’s a prime target for cybercriminals. The average Microsoft 365 tenant contains 58% of an organization’s sensitive cloud data and, arguably, houses the most powerful privileged accounts a business has.
Acknowledging gaps in their cyber resilience preparedness, CISO involvement, regulatory compliance, and in measuring cyber risk, enterprises are flying blind, meaning that cyber resilience needs to be atop the C-suite’s list for strategic investment. For Microsoft 365 specifically, organizations face a rapidly evolving and expanding attack surface, a dangerous lack of visibility, potential for misconfiguration and error, a constant barrage of Microsoft-specific changes, among other challenges. For example, the 2024 Hiscox Cyber Readiness Report states that 67% of companies reporting repeated cyber attacks in the past year, it’s a question of when and how often – not if – an enterprise will fall victim to a breach or find their M365 cyber resilience lacking.
According to the 2025 Microsoft Vulnerabilities Report, a record-breaking 1,360 security vulnerabilities were experienced across its products, up 11% from the previous reported high in 2022. While the overall number of critical vulnerabilities is declining, the focus is shifting towards identity protection due to the prevalence of remote code execution (RCE) and elevation of privilege (EoP) vulnerabilities, which are primary targets for attackers.
Industry surveys have consistently revealed that Microsoft 365 tenants face a constant barrage of attacks.
Nation state attackers like Nobelium (Midnight Blizzard) and Hafnium have consistently prioritized attacks on Microsoft 365 tenants, to the point that CISA mandated that all federal agencies implement secure configurations across all Microsoft 365 tenants by June 20, 2025.
Outside of the public sector, a Vectra survey of over 1,000 security professionals found that 71% of Microsoft 365 deployments had suffered an average of seven successful account takeovers.
Your tenant will be breached. Cyber resilience techniques for Microsoft help you withstand attacks and recover more quickly.
The Four Components of Cyber Resilience for Microsoft Tenants
“The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.”
Let’s break this down into its four constituent parts and look at what this may involve for Microsoft 365.
Anticipate Attacks in Your M365 Tenant
Whereas traditional security builds defenses based on an existing understanding of best practices, cyber resilience implores security teams to look ahead and anticipate emerging threats and trends.
No one can predict the future, but you can ensure you partner with vendors and service providers who react quickly to the threat landscape. And you can implement an internal process to review emerging threats frequently and adapt your internal standards appropriately.
Implementing this process is a strong starting point. But it should also include a practical way to make changes quickly. For example, if you identify a requirement that your existing toolset cannot deliver, you will be able to adapt faster if you have an extensible platform.
Withstand Attacks in Your Microsoft Tenant
It’s obvious that every organization should implement strong access-level security for its tenants, such as email filtering, a zero-trust framework for authentication, and cloud access control.
However, withstanding an attack means implementing security measures to minimize the impact when someone successfully outwits or bypasses these controls.
To minimize the impact when your tenant is breached, you will want to make it as difficult as possible for cybercriminals to move laterally, elevate their privileges, persist in your tenant, and reach their final objective.
There are now over 10,000 unique policy elements across Microsoft 365’s many configuration types, with many of these designed to have multiple variations (e.g., multiple user groups or conditional access policies).
This means the day-to-day operation of a Microsoft 365 tenant may rely on hundreds of thousands (or in some cases millions) of unique configurations.
With this complexity, it is now critical that organizations keep their Microsoft 365 tenant configurations backed up, ready to be restored in the event of a disaster.
Adapt Your Tenant Security Measures
The final element in the NIST definition of cyber resilience is the ability to adapt and continuously improve your tenant security based on what you learn from past incidents. To do this, it is critical that you work with extensible platforms that allow you to adapt them to your unique requirements.
The Four Pillars of Cyber Resilience in Microsoft 365
How to Reach Microsoft 365 Cyber Resilience Maturity
Without a clear plan, attackers can spread laterally, escalate privileges, and exfiltrate data before you even detect them. Detect intrusions early, contain threats, and recover before attackers cause serious damage by using this maturity model framework.
Maturity Model Level 1: Access Security and Data Backup for Your Tenant
At level 1 of the maturity model, the goal is to safeguard Microsoft 365 tenant cyber resilience and reduce the likelihood of initial compromise in your tenant. Implementing the controls associated with level 1 will help you enforce strong user access, email filtering, and data access controls for your tenant—all things that drive down the risk of an initial breach.
Basic cyber hygiene: Fundamentals of cybersecurity that feed into zero trust frameworks are your basic cyber hygiene toolbox. Identity and access management concerns, such as enforcing password policies, implementing mandatory multifactor authentication, tailoring conditional access policies, and restricting users to just enough access through least-privilege principles, lead the way, with device security and compliance and remote management controls, threat protection and monitoring, tracking configuration drift, and so on, fill out the complete picture. Also, measuring your overall security posture with Microsoft Secure Score can also help you gain some quick wins in terms of both cybersecurity and compliance and help guide the basics of your security risk assessment.
Privileged access management versus least privilege: A recent Microsoft vulnerability report highlighted enforcing least privilege as “one of the most effective strategies to reduce risk”. Restricting access rights and what users are able to do based on their role reduces the scope of vulnerabilities. In fact, the CoreView State of M365 Security found that organizations that have deployed privileged access management solutions have 64% fewer security incidents.
Email filtering: Email remains the top vector for most security breaches, according to CrowdStrike, making email filtering a no-brainer as a basic hygiene measure. Maintaining control over mailbox permissions is a foundation of M365 tenant cyber resilience and is critical for compliance. This is especially important at crucial pivot points, such as employee onboarding, during role changes, and during offboarding. Implementing email filtering in M365 is essential to block initial attack vectors, protect sensitive data, and complement an organizational zero trust strategy by assuming email is untrusted by default.
Cloud-based access control: Role-based access control is a way to approach least privilege access while functional access control is a way to achieve it. Least privilege is not well implemented in Microsoft because it is not granular enough and assumes that a role-based approach is enough. Effective cloud-based access control should adopt a transparent and granular approach based both on role and on what functions that role needs to perform (which can also easily be rescinded, as needed).
Data backup: CoreView’s 2025 State of M365 Security report found that 96% of surveyed IT leaders had their data backed up (or soon would). Great news – and a good first step to overall resilience but not the whole story. Without configuration backups, there is no tenant to restore the data to.
Maturity Model Level 2: Configuration and Backup in Microsoft 365
At level two, you’re aiming to reduce the impact of compromise once someone has accessed your tenant. The controls here include backing up your configurations, deploying secure configurations, detecting configuration drift, enforcing configuration change management, and detecting and testing new Microsoft updates before they’re rolled out.
Configuration backup: CoreView’s 2025 M365 State of Security report found that almost 50% of survey respondents believed that Microsoft backs up their tenant configurations and will restore them after an incident. This is false. Microsoft 365’s backup and restore options have critical gaps: configuration settings, roles, and policies are frequently uncovered. Prioritizing configuration backups is critical to M365 tenant cyber resilience.
Deploy secure configuration: If your tenant is encrypted or its configurations altered or deleted, you will have to rebuild your tenant from scratch if you have not backed them up. And rebuilding piece by piece manually inevitably introduces errors, risks, and delay. Backing up your configurations ensures the consistency you need for security and business continuity.
Detect configuration drift: A single misconfiguration could lock your entire business out of your tenant, expose you to a devastating cyber attack or lead to downtime across your global supply chain. Independent analyses also show that there has been a 79% increase in configuration tampering since 2023. Why then is it such a painful, manual process to manage configuration change and drift with M365? It does not have to be.
Enforce configuration change management: Related to detecting config drift, configuration change management is key to maintaining consistency across dev, test, and prod tenants – and for understanding when configuration tampering happens. Change management is a cornerstone of being able to monitor configuration status and drift. It’s likewise critical for compliance with major regulations like NIST, CMMC, CIS, and HIPAA.
Test new M365 updates before rollout: Testing any updates before going live makes sense to minimize disruption, identify issues, verify that updates don’t disable security or introduce compliance gaps, and validate performance.
Maturity Model Level 3: Least Privilege and Collaboration
With your configurations now tamper-proof, Level 3 looks to remove common escalation vectors and pathways that cybercriminals love to exploit. Controls for level 3 include:
True Least Privilege Admin Roles: Avoid the trap of assigning global admin roles too broadly, and manage Microsoft 365 least privilege with care. The 2025 CoreView State of M365 Security report found that organizations with 10 or more global admin accounts were 1.8x more likely to experience frequent account compromise incidents. Taking care of this takes care of your cyber resilience, security – and even the mental health of your CISO and cybersecurity teams.
Entra App Management: Even well-managed Microsoft tenants are complex enough that it’s hard to monitor all the potential risks (like unused guest accounts, stale admin roles, or risky app permissions). These issues often slip through routine reviews and create hidden attack paths. Entra apps can have read-write permissions that can be a Trojan horse of your organization, opening a massive attack surface. CoreView’s 2025 State of M365 Security Report revealed that 51% of organization have more than 250+ active Entra applications with full read-write permissions. This screams of Entra App mismanagement or neglect, but you don’t have to settle.
External User and Collaboration Security: One of the biggest security deficiencies is poor external or guest user governance. It’s important when opening up any of your data or applications to external users that you determine what type of access a guest needs – and giving them only just enough to be able to take care of what they are working on.
Detect High-Risk Files and Sharing: The ability to detect high-risk files and sharing activities in M365 might seem overwhelming but with auditing tools that let you track file access and the creation of anonymous links, monitor and alert any suspicious application behavior, and any other suspect risks, you can close this often overlooked security loophole. Being able to secure sensitive data in documents, Microsoft Teams, and SharePoint sites with sensitivity labels can aid in controlling exactly who can access what before you reach the high-risk sharing stage, and Information Rights Management (IRM) can help control access further by restricting what users can do with documents.
Detect Suspicious Mailboxes: Exchange Online remains a favorite target for attackers, especially when default settings leave forwarding rules, legacy auth, and shared mailboxes exposed. Implementing basic cyber hygiene measures, such as MFA, and blocking auto-forwarding, you can make inroads into securing email. But you also need to be able to implement mailbox auditing and monitor for suspicious activity and malicious content to be able to block and respond.
Maturity Model Level 4: Governance and Automation
By the time you come to Level 4, you have put layers of resilience into your tenant to slow attackers down to a crawl. The next step is to implement governance and automation to keep your attack surface lean and your response time fast.
This final level involves implementing sprawl and lifecycle management, user access reviews, enhanced audit and reporting, secure task management, and rapid extensibility.
Implement sprawl and lifecycle management: Sprawl can be a real problem, and without visibility into license management and the user lifecycle, you can easily have a host of open security vulnerabilities while also leaving money on the table due to unused licenses. It’s possible to automate lifecycle management to better govern your Microsoft 365 resources.
Perform user access reviews: Compliance frameworks like NIST, NIS2, HIPAA, and CIS require organizations to perform ongoing user access reviews. Beyond compliance, without ongoing access reviews, privilege and access sprawl in M365 is not manageable, which increases risk and complexity.
Adopt enhanced audit and reporting: Audit logs capture the full picture of what happens within a Microsoft 365 environment and provide critical data for both security and compliance use cases. For security analysis and incident response, audit logs are an essential tool. And then for regulatory compliance and reporting, audit logs provide the required paper trail documenting compliance.
Secure task management: Managing tasks effectively is all about automation. It boosts productivity, reduces the scope for human error, and makes people’s jobs easier, allowing them to focus on high-value tasks rather than repetitive admin work.
Rapid extensibility: Rapid extensibility matters for Microsoft 365 because it enables agility. Businesses can quickly adapt, respond, and recover from evolving cyber threats, integrating new detection rules, tools, or compliance policies, implementing faster incident response and recovery, scaling and adjusting quickly and being able to integrate M365 with broader security ecosystems.
Most Common Issues That Undermine Microsoft Cyber Resilience
Many of the topics we’ve covered in the maturity model are the same as those that are the most common issues that stand between you and Microsoft 365 cyber resilience.
Misconfigurations and configuration drift
Many organizations fail to configure their key security features, leaving defaults in place. Or human error leads to misconfigurations. Or, yet again, a configuration tampering attack leaves you exposed. And further still, Microsoft could have made changes you don’t know about that altered your configurations or made existing configurations not work properly anymore. Whatever the configuration issue – any of these can increase your exposure to compromise.
Lack of identity and access management oversight
Whether it’s weak credential enforcement, no MFA enforcement, overuse of global admin accounts, too much read-write privilege for Entra apps, or insufficient monitoring of privileged accounts, there are all manner of ways for sensitive data to leak out or bad actors to get in and gain unauthorized access to the M365 crown jewels and do real damage.
Inadequate email threat protection
Microsoft 365’s default email security is not enough to protect enterprises against the aggressive, creative, and advanced attempts to break through via phishing, malware, and other forms of social engineering. Introducing advanced anti-phishing policies and tuning Safe Links and Safe Attachments features as well as implementing internal training to help reduce the risk that your people are your weakest link.
Insufficient backup and recovery planning
Many enterprises assume incorrectly that their tenant configurations are backed up by Microsoft and will be ready to restore. While Microsoft provides data availability, there is no native solution for long-term backup, and this can lead to losses in productivity, critical data, regulatory hassles, financial consequences and more.
Poor visibility
Organizations often don’t deploy native Microsoft tools like Microsoft Defender, let alone adopt tools that would improve visibility and help detect problems before they become problems. This leads to delayed incident response and potential for much further-reaching business consequences.
Failure to review and audit
Enterprises cannot improve if they don’t continuously review their security posture and performance – this is ongoing in the same way that vulnerabilities are not static. The complexity of M365 makes it impossible to do this kind of systematic review and audit manually and as regularly as would be recommended. And as such, you will miss new vulnerabilities, configuration and policy drift, and ultimately, a lot of red flags. Conducting regular Microsoft Secure Score reviews and running risk assessments and security audits can help you head off future problems and secure cyber resilience for your organization.
Resources to Help Improve M365 Cyber Resilience
Microsoft 365 Cyber Resilience Maturity Model
The Cyber Resilience Maturity Model for Microsoft 365 covers each level of the maturity model in-depth, including recommendations and best practices from Microsoft experts to build cyber resilience into your day-to-day operations.
Preview of CoreView’s Microsoft 365 Cyber ResilienceMaturity Model
White paper on the Anatomy of a Microsoft 365 Attack
To get inside your tenant, attackers use all kinds of tactics—some new, some old. Stay up to date on the latest attack tactics from cybercriminals to strengthen your organization’s defenses against evolving threats.
It takes attackers just 16 hours to reach your directory.
And, once inside your tenant, attackers will find and hijack high-privilege accounts. Counteract these attacks by identifying accounts with excessive permissions and reducing exposure with the Admin Permissions Scanner for Microsoft 365.
Preview of the Admin Permissions Report for Microsoft 365
Building an Effective Cyber Resilience Strategy with CoreView
With CoreView, you get the tools you need for true cyber resilience for your Microsoft tenant. Our rapid response and secure automation tools make tenant protection more than just a preventative measure:
Create admin roles with “just enough” access.
See which of your integrated apps have powerful permissions in your tenant.
Detect when attackers change configurations with comprehensive change management.
Backup configurations so you can roll back and restore them when disaster strikes.
Take control of guest users and sharing in your tenant.
Enforce tenant lifecycle management to keep your attack surface as small as possible.
