Microsoft 365 misconfigurations to check now: identity, data and devices

Identity: Microsoft Entra ID

Setting	Why it’s risky	What to do
MFA isn’t enforced for every user	An account without MFA falls to one leaked password	A Conditional Access policy that requires MFA for everyone, and phishing-resistant MFA for admins
Too many Global Administrators	Each one is a path to full control of the tenant	Microsoft recommends fewer than five. Two emergency (break-glass) accounts, everyone else in narrower roles or PIM
Users can consent to any app	A malicious app gets access to mail and files straight from the user (consent phishing)	Allow consent only for apps from verified publishers and low-impact permissions, and turn on the admin consent workflow
Anyone, including guests, can invite guests	No control over who joins the tenant and why	Limit invitations to admins and the Guest Inviter role
Users can create tenants	Whoever creates a tenant becomes its Global Administrator, outside your control	Turn on "Restrict non-admin users from creating tenants" and give the Tenant Creator role only to those who need it
Users can register apps and create security groups	Ownerless, unmanaged objects pile up in the tenant	Turn both off in User settings and grant them through roles

Account protection continues with the tokens issued after sign-in. We wrote a separate guide on that: tokens in Microsoft Entra ID.

Data: SharePoint, OneDrive and DLP

Setting	Why it’s risky	What to do
"Anyone with the link" sharing is allowed	Whoever gets the link opens the file, without signing in	Restrict it for the organization or sensitive sites, and set link expiration
External sharing is open to any domain	Data reaches people nobody approved	Limit to approved domains where needed, and review guest access regularly
No DLP policy	Sensitive data leaves by email or sharing and nobody knows	Start from a Microsoft Purview template in test mode, and only then block

Devices: Intune

Setting	Why it’s risky	What to do
Conditional Access doesn’t require a compliant device	Unmanaged devices, including an attacker’s, reach company data	A policy that requires a compliant device, at least on Windows and macOS
A device with no compliance policy counts as compliant	That’s the Intune default. A device nobody assigned a policy to passes Conditional Access	Set "Mark devices with no compliance policy assigned as" to Not compliant, as Microsoft recommends
Compliance policies are too weak	A device without encryption or a firewall counts as healthy	Require at least BitLocker, Secure Boot, firewall, TPM and antivirus, per Microsoft’s recommendations
Security baselines aren’t deployed	Every device ends up configured a little differently, with gaps	Deploy the Windows and Defender for Endpoint baselines, and update them when Microsoft releases a new version
No app protection policies for phones	Company data stays on a personal phone when an employee leaves	A policy that protects data inside Outlook, Teams and OneDrive, without managing the whole phone

The real problem: settings drift

Even a well-configured tenant doesn’t stay that way. An admin excludes themselves from a policy to test something, a vendor gets permissions "for a week", a policy is turned off during an outage. Without continuous checks, you find these changes only when something happens.

Where to start

MFA for everyone, and phishing-resistant MFA for admins.
Count your Global Administrators and get below five.
Restrict app consent, guest invitations and tenant creation.
Change the Intune default for devices with no compliance policy, and require a compliant device in Conditional Access.
Restrict Anyone links and turn on DLP in test mode.

How Griffin31 helps

Griffin31 checks the security settings in your Microsoft 365 tenant continuously, including Entra ID, sharing and Intune, and shows you what to fix first, with the evidence behind the results.

Want to know how many of these settings are open in your tenant? Griffin31 checks your Microsoft 365 security settings continuously and shows you what to fix first.

Book a demo