# Microsoft 365 and Cloud Security Review > Microsoft 365 and Azure are where a lot of business now lives — and their default settings are rarely the safest. A cloud security review surfaces what's quietly exposed. *Source: https://panoptic.ie/blog/microsoft-365-cloud-security-review* # Your Microsoft 365 and cloud setup Microsoft 365 and Azure are where a lot of business now lives — and their default settings are rarely the safest. A cloud security review surfaces what's quietly exposed. David Griffith · 1 June 2026 ![A frosted glass cloud on a steel base with three toggle switches set into it](https://panoptic.ie/_astro/blog_microsoft_365_cloud_security_review_a7334536aa_Z250YeO.jpg) In short Microsoft 365 and Azure are where a lot of business now lives, and their default settings are rarely the safest. A cloud security review checks identity, sharing, mail flow and administrative access against current best practice, then gives you a prioritised list of what to change. Microsoft 365 and Azure hold the email, the files, the identities and increasingly the phone system. They are also configured, in most businesses, roughly the way they were on day one. That is the problem a cloud security review addresses. Defaults are chosen to make a tenant work for everyone, not to make yours safe. ### The shared responsibility line The single most common misunderstanding is about who protects what. Microsoft protects the platform: the data centres, the hardware, the availability of the service. **You are responsible for the data in it, and for how it is configured.** That means identity, access, sharing settings, retention, endpoint protection and compliance policy all sit on your side of the line. Nothing about that is hidden, but it is rarely read until after something goes wrong. ### What the review examines **Identity, first and always.** Account compromise is the route into a cloud tenant, so this is where the review starts. Is multi-factor authentication enforced for every account, including the ones people forget: service accounts, shared mailboxes, the administrator account created during setup? Are there legacy authentication protocols still enabled, quietly bypassing MFA entirely? Are conditional access policies doing anything, or present but scoped to nobody? **Administrative access.** How many global administrators does the tenant have? The answer is almost always higher than it should be. Standing administrative rights on a day-to-day account mean one phished session hands over the whole tenant. **Sharing and external access.** Which files and sites are shared with anyone who has the link, and how many of those links have no expiry? Guest access accumulates; departed contractors often still have it. **Mail flow and anti-spoofing.** Whether SPF, DKIM and DMARC are configured well enough to stop someone sending mail that appears to come from your domain. Partial configuration is common and offers far less protection than people assume. **Auditing.** Whether audit logging is switched on and retained long enough to be useful. After an incident is a poor time to discover the logs were never being kept. ### Retention is not backup This deserves its own section, because it is the assumption that costs businesses the most. Microsoft 365's native retention windows are shorter than most people expect. Deleted items in Exchange Online are held for **30 days** by default. The SharePoint and OneDrive recycle bins hold for **93 days**. More importantly, retention is a policy mechanism, not a recovery mechanism. It has no point-in-time restore for a mailbox, and it offers no protection against someone changing the retention policy itself. A compromised administrative account can shorten retention and then delete, and the native tooling will not save you. If you want the full argument, we set it out in [email and data you can get back](https://panoptic.ie/blog/email-and-data-backed-up). The short version: independent backup of Microsoft 365 is a separate control, and the review will say so. ### What tends to come back Recurring findings across Irish SME tenants, in rough order of frequency: - MFA missing on at least one privileged or service account - More global administrators than the business can name - Anonymous sharing links with no expiry, often numbering in the hundreds - DMARC absent or set to `p=none`, so spoofing is monitored but not blocked - No independent backup of the tenant None of these are exotic. All of them are fixable in days rather than months. ### The compliance dimension For businesses in scope for NIS2, Article 21's ten minimum measures cover access control, incident handling and business continuity, all of which land squarely on tenant configuration. Ireland's NCSC published board-level guidance in July 2026, and the expectation is that senior management can evidence these controls rather than delegate them out of sight. If you are below the size thresholds, the pressure arrives through the supply chain instead: regulated entities must assess their providers, and tenant security questions are now standard in those assessments. ### How the review is delivered For managed-service customers this runs as part of the ongoing service rather than as a separate project. For everyone else it is a scoped engagement: a read-only assessment of the tenant, a report ranked by risk, and a remediation plan split into what to change immediately and what to schedule. We do not change settings during the assessment. Findings come with the specific configuration change required, so you can act on them with us or without us. To arrange a review of your Microsoft 365 and cloud setup, [get in touch](https://panoptic.ie/contact) or read more about [penetration testing and vulnerability scanning](https://panoptic.ie/services/penetration-testing-vulnerability-scanning). [All field notes](https://panoptic.ie/blog) ## Start with a free IT review. You'll get a clear picture of where you're exposed today, and what it looks like to have your whole IT covered as one managed system. No obligation. [Talk to us ](https://panoptic.ie/contact)[See how we onboard](https://panoptic.ie/how-we-onboard)