Microsoft 365 is secure by capability, not by default. The tenant you were given on day one is configured for compatibility and smooth onboarding — which means several settings are deliberately permissive. Attackers know exactly which ones.
Here are the areas that account for most business email compromise cases we are called into, and none of them require additional licensing to address.
Legacy protocols — POP, IMAP, SMTP AUTH and older Exchange endpoints — cannot present an MFA challenge. An attacker with a valid password can authenticate through them regardless of your MFA policy. Blocking legacy authentication is the single highest-impact change in most tenants, and the main obstacle is usually one multifunction printer that scans to email.
Most tenants have MFA on interactive sign-in. Fewer have covered service accounts, break-glass account monitoring, or privileged role activation. Fewer still have moved off SMS, which is vulnerable to SIM swapping. Number matching and an authenticator app should be the baseline.
Auditing is enabled by default now, but retention is short and nobody is looking. In a compromise, the questions asked are always the same: when did the attacker first sign in, what did they read, and did they exfiltrate anything? Without audit logs of sufficient retention, those questions are unanswerable — which matters both for remediation and for breach-notification obligations.
The classic business email compromise does not end with reading mail. The attacker creates an inbox rule that forwards anything containing "invoice" or "payment" to an external address, then leaves. Access is revoked weeks later when the password is reset; the rule survives. Automatic external forwarding should be blocked at the transport level, with exceptions granted deliberately.
By default, users can grant third-party applications access to their mailbox and files. Consent phishing exploits exactly this: the victim never enters a password, they simply approve an OAuth prompt for a convincing-looking app. Restrict consent to admin approval with a request workflow.
Conditional access is where the platform's real strength sits, and it is routinely underused. Practical baseline policies:
Microsoft Secure Score is a reasonable starting instrument — not because the number matters, but because it enumerates what is unconfigured. Work down it by risk rather than by points, and record deliberate exceptions so the next person understands why something is open.
We run tenant hardening reviews as a fixed-scope engagement, including the printer-that-scans-to-email problem that blocks most legacy authentication projects. Get in touch if you would like a review of your tenant.