Overview

As organisations adopt a cloud-first approach, common misconfigurations arise from those that simply “throw their data in the cloud”. While each cloud vendor provides a swath of services that leverage cloud capabilities for ease of use, many configurations inadvertently provide a larger attack surface area.

There is a notable rise in security incidents involving these platforms and associated services. As the standard for cloud adoption, Microsoft 365 is highly sought after due to its popularity and ubiquity for organisations. Compromised Microsoft 365 and Azure tenants can lead to unauthorised third-party remotely access to sensitive data without having to penetrate the perimeter.

Not all Microsoft 365 implementations are the same. While there are standard baselines and default settings that should be enabled, we understand that each client may use their cloud subscriptions different than the rest. As such, we review each of the following “pillars” of the cloud environment, looking for misconfigurations and security flaws using manual and automated tools. These pillars include the following segments of each portion of Microsoft 365’s Suite:

• Overall tenant configuration and security
• Azure Active Directory
• Security & Compliance Centers
• Endpoint Manager
• Exchange Online
• SharePoint and OneDrive
• Teams

Within each of these pillars, we review current settings and compare them to baselines identified by Microsoft and industry best practices to identify gaps and misconfigurations. Each item is captured, reviewed, and provided to your organisation with risk and associated remediation steps to help reduce the attack surface area.