I moved into Microsoft security assuming most organisations had cybersecurity under control. The reality was messier, from missing tenant backups to a phone scam that caught out a cybersecurity professional.
In this article
Moving from marketing ops into Microsoft security revealed a wide gap between the security best practices organisations know about and the ones they actually enforce.
Microsoft doesn’t automatically back up M365 tenant configurations, and roughly 90% of the organisations the author has observed lack proper backup procedures, with some relying on portal screenshots saved in Word files.
Low problem awareness, entrenched manual habits, and a cybersecurity blind spot among non-technical staff leave known risks unaddressed, while end users have little control over settings such as file-sharing expiry.
Voice phishing can catch out even experienced cybersecurity professionals, and with AI accelerating attacks on businesses and governments alike, controls such as virtual tenant segmentation help limit what a compromised account can reach.
Before moving into the Microsoft security space, I thought most IT organisations had cybersecurity at least somewhat under control.
I might’ve been a tad optimistic.
My background is in marketing ops, and I’ve spent the last 5 years working in Google Workspace environments alongside IT and security teams. I’d always figured those people had the tools and expertise to keep everything locked down tight.
It wasn’t until I started in IT security that my naivety dawned on me. The more I learnt about cybersecurity, the less confident I felt that organisations had the necessary tools.
Here are some of my key takeaways.
Best practices exist. But they aren’t always being followed.
Admins aren’t supposed to have exposed email addresses. Everybody knows this. It’s a huge security risk. Yet many of them do.
That was the single most striking thing I learned after joining the team. Security isn’t just knowing the rules. It’s also about following them.
Microsoft doesn’t automatically back up your M365 tenant configuration. Most people don’t actually know this.
Before moving into Microsoft security, I figured any decent-sized organisation would have some level of configuration protection. I was wrong.
From my observations, roughly 90% lack proper backup procedures. I’ve even seen some teams store screenshots of portal settings within Word files.
Before joining CoreView, I thought I’d be duking it out in a crowded market where vendors compete ferociously for consumer attention. But market saturation isn’t the issue here. Problem awareness is a much bigger challenge.
If an organisation doesn’t know something is wrong, it won’t look for a solution. Rather than pushing out new tools, we need to spend more time helping organisations better understand the risks that already exist.
When a process is done a certain way for a long time, rightly or wrongly, it becomes best practice.
For example, a manual process that keeps being repeated despite effective automation tools. People will keep doing it the old-fashioned way because ‘that’s how they’ve always done it.’
Switching approaches takes conscious effort, even when the new process is inherently more efficient.
Staff outside the tech sphere might have a rudimentary understanding of cybersecurity at best. Most feel the IT security team is solely responsible for handling these issues.
Few seem to understand the severity of potential breaches, nor how crucial it is to adopt a collaborative, whole-of-organisation approach.
Ongoing cybersecurity education is just as important for general staff as it is for IT teams.
Take file sharing as an example.
When you’re sharing a SharePoint or OneDrive link, you get to choose who gets access to which files. Sometimes you can also decide what they can do, such as editing or viewing.
But you never get any say in the access timeframe. The IT team controls the file-sharing expiry settings, which creates a responsibility gap if an authorised person gains access in the future.
End users can only do so much with the permissions they’ve been given.
Many organisations are running phishing simulation exercises, and they’re generally pretty successful. As email is still the highest-value attack vector, most simulations target the admins who hold the keys.
An after-work catch-up with a colleague transformed how I treat incoming calls. He got a call on his mobile showing ‘Google’ on the caller ID.
A calm, professional-sounding man said someone was trying to access his personal Google account. The attacker might have had an insider sending identity-confirmation requests, because my colleague received one and approved it, thinking the call was legit.
Within seconds, the attacker was in his Google account and trying to access his financials.
My colleague isn’t a gullible, overly trusting retiree like you see getting swindled on A Current Affair. He’s a smart young cybersecurity professional, and even he got done.
Since then, I have zero trust in incoming calls. I’ll screen every single person, follow password manager best practices, hang up and call the head office. The works.
Personal vigilance only goes so far, though. Sooner or later, someone in your organisation will trust the wrong caller, and what matters then is how much an attacker can reach with the account they’ve compromised. That’s where my next lesson comes in.
Complex-sounding concepts are sometimes simpler than they seem. One thing I struggled with at first was virtual tenant segmentation, until somebody explained it to me this way.
A tenant is like a government operating multiple departments. Different departments, such as Forestry and Agriculture, can share the same environment. Admins can see everyone but only need to manage their own department.
CoreView lets you set filters, such as @agriculture.gov, to ensure an admin only sees and responds to issues in their own department. That means less cross-departmental tampering and less risk of harm from a compromised account.
At first I thought organisations would have too few tenants and need to split them up. But it didn’t take long to realise that more often there are too many tenants and no way to delegate between them.
Five different tenants means five different workspaces, each with Teams, Outlook, and SharePoint dashboards.
Google Workspace feels disjointed to me now. Productivity tools over here and communication apps over there.
The big difference I noticed with Microsoft 365 is how interconnected everything is. All the tools intertwine, and Copilot integrates directly into products like email, Teams, and PowerPoint.
All this made adaptation easier than expected (I don’t miss Slack or Google Suite). It didn’t take long for the new ecosystem to feel natural.
Nobody told me how frantic this field would be.
Cyber runs 24/7 at breakneck speed. Microsoft is constantly shipping new products and updating its features and settings.
The attacks are speeding up too. AI has cut the time it takes to compromise a Microsoft 365 tenant from weeks to seconds, and governments are squarely in the firing line. When Western Australia’s Auditor General reviewed Microsoft 365 security across seven state government entities, none had a complete backup of their tenant configurations.
Elsewhere, one government department had its tenant held to ransom and spent three and a half months rebuilding it from scratch, with library systems offline and emergency services reverting to manual operations.
If that can happen to the agencies running our public services, I don’t think anyone is safe.
If any of these lessons sound familiar, my team can help you find the gaps in your Microsoft 365 tenant before an attacker does. Book in for a security briefing with CoreView.
