Beyond failing to implement basic security practices, researchers warned that organizations are giving administrators excessive controls (which results in increased access to sensitive information).įor instance, researchers found that 57 percent of global organizations have Microsoft 365 administrators with excess permissions to access, modify, share critical data – potentially giving them unnecessary access to private data and opening up risks for insider threats.Īnother issue is that companies are investing in various productivity applications without consideration their security implications. Overall, researchers found overarching issues with how Microsoft 365 is being implemented in companies. However, the research reveals that Microsoft 365 users – and even admin accounts, with the highest level of permissions and oversight of data – are not doing their part to implement MFA for their accounts. MFA is one of the best ways to prevent this type of unauthorized access to Microsoft 365, researchers said – with research from SANS Software Security Institute indicating that 99 percent of data breaches can be prevented using MFA. Attackers typically targeting Microsoft 365 accounts email-based phishing or spear phishing attacks, automated credential stuffing, or guessing attacks.

Microsoft 365 accounts are a treasure trove for cybercriminals looking for sensitive organization data. “This is a huge security risk – particularly during a time where the majority of employees are remote – that IT departments must acknowledge and address in order to effectively deter cyberattacks and strengthen their organization’s security posture,” according to the report, released last week.

Launched in 2017, this service provides users with basic productivity applications – including Office 365, Windows 10 and Enterprise Mobility. Up to 78 percent of Microsoft 365 administrators do not have multi-factor authentication (MFA) security measures enabled.Ī recent report by CoreView Research also found that 97 percent of all total Microsoft 365 users do not use MFA, shedding a grim light on the security issues inherent with the implementation of Microsoft’s subscription service.

Enable mfa office 365