Microsoft 365 is not secure out of the box. Three gaps show up often in small business Microsoft 365 setups: multi-factor authentication that isn’t applied to all users, legacy authentication protocols that bypass MFA entirely, and email forwarding rules that send copies of messages to outside addresses. All three are fixable with the right configuration.

Key Takeaways

Microsoft 365 does not enable multi-factor authentication for all users by default. Admin accounts often have it; regular staff accounts frequently do not.
Legacy authentication protocols (Basic Auth) can still be active in many M365 tenants. These older protocols bypass MFA entirely, making that protection useless for those connections.
Email forwarding rules can be created silently by current or former staff. Without regular audits, copies of business emails may be leaving your organization without anyone knowing.
Each of these gaps is fixable. None require replacing M365 or buying additional software. They require correct configuration and someone who knows where to look.
Cyber Shift Technologies has served 235+ businesses since 2016. These three gaps are common in Microsoft 365 setups that nobody revisits after the initial setup, especially where there’s been no formal IT review.

Gap 1: MFA Is Not On for Everyone

Multi-factor authentication, or MFA, is the security step that asks you to confirm your identity a second way after entering your password. A text message code, an app notification, a one-time number. You’ve probably seen it.

Most business owners assume that because they set up M365 and use MFA themselves, everyone on the account does too. That’s not how it works.

Microsoft enables MFA by default for global administrator accounts. But standard user accounts, the ones your staff log into every day to check email and use Teams, often do not have it enabled unless someone explicitly turned it on. It’s common to find a mix: the owner has MFA, a couple of senior staff do, and the rest don’t.

That gap matters. Stolen or guessed passwords are the single most common way attackers get into business Microsoft accounts. If a staff member’s account has no MFA, a leaked password is the only thing standing between an attacker and your email, your OneDrive files, and every application connected to that account.

Security Warning
According to Microsoft’s own research, MFA blocks more than 99.9% of account compromise attacks. But it only blocks attacks on accounts where it’s actually turned on. A single unprotected account in your tenant is an open door.

How to check: in the Microsoft 365 admin center, go to Users and look for Active Users. There’s an option to filter by MFA status. You’ll see which accounts have it enabled, which have it disabled, and which have never set it up at all. If you don’t recognize the admin center interface, that’s a reasonable signal to ask your IT provider to run through it with you.

Gap 2: Legacy Authentication Is Still Open

Legacy authentication refers to older protocols, like Basic Authentication, that older email clients and applications use to connect to Microsoft 365. Think of older versions of Outlook, some shared printers that email documents, or third-party apps that connect to your M365 account without going through Microsoft’s modern login page.

Here’s the problem. These older protocols don’t support MFA. When a connection uses Basic Auth, it sends just a username and password. The MFA step is skipped entirely. So even if you have MFA enabled on an account, an attacker who uses a legacy authentication path to connect can get in without the second factor.

Microsoft has been working to disable Basic Auth across M365 for several years. But the process has been gradual, and some tenants, particularly older ones that were set up without active IT management, still have legacy authentication enabled for certain protocols. It doesn’t announce itself. You have to look for it.

By the Numbers
Microsoft Security Intelligence has reported that legacy authentication protocols are involved in more than 97% of credential stuffing attacks and 99% of password spray attacks against M365 accounts. Blocking them removes one of the most common attack paths entirely.

How to check: in the Microsoft Entra admin center (formerly Azure Active Directory), you can run a sign-in report filtered by legacy authentication. Look for any successful sign-ins that used Basic Auth or other older protocols. Your IT provider can also set up a Conditional Access policy (a rule that controls how accounts can be accessed) to block legacy authentication entirely. This is one of the highest-return configuration changes available in M365.

Pro Tip
Before blocking legacy authentication, check whether any printers, scanners, or older line-of-business applications use it to send email through M365. These devices need to be updated or reconfigured before you flip the switch, or they’ll stop working.

Gap 3: Email Forwarding Rules No One Set Up

This one is the most surprising to most business owners. Your email in Microsoft 365 allows users to create rules that automatically forward copies of incoming messages to another address. These rules can be set up silently, they run in the background, and nothing in the normal email interface flags them as unusual.

Two situations create this gap. The first is a current employee who sets up a personal forwarding rule, maybe to keep work emails going to a personal Gmail account. The second is more concerning: a former employee whose account wasn’t properly offboarded, or an attacker who gained access to an account and set up forwarding to quietly collect copies of business communications.

This gap turns up more often than you’d expect. Often, the business owner has no idea the rule exists. The emails kept arriving in the regular inbox too, so nothing looked wrong.

What This Means for You
If a forwarding rule is sending copies of emails to an external address, that includes invoices, client communications, contracts, HR conversations, and anything else that comes through the affected inbox. The data leaves your organization continuously, for as long as the rule is active.

How to check: in the Microsoft 365 admin center, go to Exchange admin center, then Mail Flow, then Rules. Look at each account’s individual inbox rules too, not just the tenant-wide transport rules. Your IT provider can run a report across all mailboxes to surface any forwarding rules that point to external addresses. Microsoft also lets you block external forwarding at the tenant level with a single policy, which prevents rules like this from being created in the first place.

Microsoft 365 Security Gaps Your IT Provider Should Be Checking

You don’t need to fix these yourself. But knowing they exist means you can ask the right questions and verify the answers.

Questions to Ask Your IT Provider About Your M365 Tenant

Is MFA enabled on every user account in our tenant, not just admin accounts?
Have you checked whether any accounts are set up with Security Defaults or Conditional Access policies?
Is legacy authentication (Basic Auth) blocked for all protocols in our tenant?
Have you run a sign-in report to check whether any legacy auth connections have succeeded recently?
Have you audited all mailboxes for external email forwarding rules, both transport rules and per-user inbox rules?
Is there a policy in place to prevent external forwarding from being set up in the future?

A good IT provider should be able to answer all of these directly. If you get vague answers or “we’ll look into it,” that’s useful information too.

These aren’t complex configurations. Each one takes minutes to verify and a short time to correct. The reason they stay open isn’t because they’re hard to fix. It’s because no one checked.

Why This Matters for Northeast Ohio Businesses

Small and mid-sized businesses in North Canton, Canton, Akron, and across Stark County tend to set up Microsoft 365 once, get it working, and move on. There’s no one checking the tenant settings on a regular basis. That’s not a criticism. Running a business takes all of your attention. IT configuration review isn’t something most business owners have time to think about.

But Microsoft 365 is the front door to most of your business data. Your email, your files in SharePoint and OneDrive, your Teams conversations, your connected applications. Getting the configuration right matters.

Cyber Shift Technologies has served 235+ businesses since 2016. These three gaps can show up in Microsoft 365 setups in any industry, from legal offices to dental practices to manufacturing companies. The industry doesn’t matter. What matters is whether someone has looked.

If you’ve never had your Microsoft 365 tenant reviewed, we can walk through it with you and tell you exactly what we find. Support and SOC monitoring are available 24/7/365, including outside office hours, and your service agreement defines how support and escalation work.

Book a Free 30-Minute Call About Your Microsoft 365 Setup

Book a free 30-minute call with our North Canton team. We’ll talk through these three gaps, what they could mean for your setup, and what a review of your tenant would involve. No guesswork. No upselling.

Call: 330-353-8420
Email: info@cybershift.com
Web: cybershifttech.com/contact

No pressure. No jargon. Just a straight conversation about where you stand and what, if anything, needs to change.

About the Author
John Wheeler is a managed IT and Microsoft 365 specialist at Cyber Shift, a trusted IT provider serving small businesses across Northeast Ohio including Canton, Akron, and Cleveland. He helps local teams get more from the tools they already use, with a focus on practical configuration and day-to-day productivity.

Frequently Asked Questions

Is Microsoft 365 secure by default for small businesses?

Not fully. Microsoft provides a baseline called Security Defaults that covers some common gaps, but it doesn’t catch everything. MFA coverage, legacy authentication settings, and email forwarding rules all require someone to actively review and configure the tenant. Many small business M365 setups were configured at initial purchase and never revisited. A tenant review is the only way to know where you actually stand.

How do I know if MFA is enabled for all my employees?

In the Microsoft 365 admin center, go to Active Users and look for the option to view multi-factor authentication status. You’ll see each account listed with its MFA state. Admin accounts often have it; standard user accounts frequently don’t unless someone set it up intentionally. Your IT provider can run this check and enable MFA across all accounts in a single session.

What is legacy authentication and why is it a security problem?

Legacy authentication refers to older connection protocols, like Basic Authentication, that some email clients and applications use to connect to M365. These protocols don’t support MFA, so they bypass it entirely. Even if MFA is enabled on an account, an attacker using a legacy auth path can log in with just a username and password. Blocking legacy authentication closes this bypass completely.

Can an employee forward my business emails to an outside address without me knowing?

Yes. Microsoft 365 allows users to create inbox rules that automatically forward copies of incoming email to any address, including personal accounts outside your organization. These rules run silently. Nothing flags them in the normal inbox view. A regular audit of forwarding rules across all mailboxes, plus a tenant policy that blocks external forwarding, prevents this. We recommend both.

How long does an M365 security review take?

It depends on the size of your tenant and what turns up. For a small business, checking MFA coverage, legacy authentication settings and forwarding rules is usually a short, focused job, and so is fixing the common problems. We give you an estimate before any work starts.

How can Cyber Shift Technologies help my Northeast Ohio business with M365 security?

Our North Canton team reviews M365 tenants for businesses across Stark County, Canton, Akron, and the wider Northeast Ohio region. We check MFA coverage, legacy authentication settings, forwarding rules, admin privileges, and more. We’ve served 235+ businesses since 2016 and answer security questions fast. Call 330-353-8420 to book a free 30-minute call.

3 Microsoft 365 Security Gaps Small Businesses Miss