Technical Guides 14 min read

Microsoft 365 & Entra ID Security Audit: The 7 Most Common Misconfigurations in Switzerland

Most Swiss organizations run on Microsoft 365. However, Microsoft's default settings prioritize user convenience over maximum security. Here are the 7 most dangerous misconfigurations uncovered during our security audits.

Author: Areg Arakelyan
Current as of:
Audit standard: ISO/IEC 27001

The 7 Misconfigurations

  • 1. Multi-Factor Authentication not enforced organization-wide or relying purely on SMS.
  • 2. Legacy Authentication protocols (POP/IMAP) left enabled, bypassing MFA prompts.
  • 3. Proliferation of Global Administrator accounts used for routine office work.
  • 4. Anonymous «Anyone» sharing links enabled by default across SharePoint and OneDrive.
  • 5. Unrestricted third-party cloud application consent by non-admin users.
  • 6. Inadequate Unified Audit Log retention and absence of anomaly alerts.
  • 7. Missing risk- and location-based Conditional Access policies.

1. Shared Responsibility in the Microsoft Cloud

Under the Cloud Shared Responsibility Model, Microsoft guarantees physical datacenter uptime. However, identity governance, access policies, and data classification remain the sole responsibility of the customer.

Areg Arakelyan

Areg Arakelyan

Lead Security Analyst, Suisse IT GmbH. Specialist in adversary simulation, attack surface assessment, and hardening of Swiss healthcare, local government, and enterprises.