Check Microsoft 365 security: Watch our webinar recording

In the webinar from October 20, 2026, Ivo Gonzenbach and Sven Nittmann demonstrate where everyday security gaps exist in Microsoft 365 and how companies can specifically secure their tenant. The recording lasts approximately 40 minutes, including a Q&A session, and can be viewed at any time. If you would like to find out where your own environment stands afterward, you can sign up for the free Tenant Security Check .

Webinar recording at a glance

• Webinar date: October 20, 2026
• Duration: around 40 minutes including Q&A
• Cost: free
• Target audience: Executives and IT managers of companies and SMEs that use or are expanding their use of Microsoft 365. No technical background is required; you will learn which questions you should be asking your IT team.

What to expect in the recording

1. The most common security risks in Microsoft 365
2. Why default settings are not enough
3. The five building blocks of a secure configuration
4. Why security is an ongoing process
5. The free Tenant Security Check
6. Q&A

The most common risks to Microsoft 365 security

These are the four risks our speakers encounter time and again during tenant analyses.

Phishing and inadequately protected identities

In the cloud, identity is the most critical area of protection. While multi-factor authentication (MFA) is now standard, phishing-resistant MFA is considered the higher security benchmark and should be the goal for as many identities as possible. At the same time, phishing remains a high risk because AI-generated emails can be linguistically convincing, leading to compromised credentials. Our article on [link] shows how to sensitize employees to such attacks in their daily work. Security training in the daily workflow with Darktrace.

Excessive administrator privileges

Users often have administrator rights they do not need, or administrator roles are not separated from standard user roles. If such an account is compromised in a phishing attack, the damage is significantly greater than with a standard user account. Therefore, it is essential to verify who actually requires administrator rights and to further restrict them using Conditional Access.

Open external sharing

Content is shared with external individuals and guests in SharePoint, Teams, and other services. Failing to regularly monitor who has access to what unintentionally opens the door to data leaks.

Why default security settings are not enough

Microsoft provides the technical platform and basic protection. The company itself decides who gets access to which data and which security features are active; the responsibility is shared. In the webinar, the speakers outline four reasons why default settings alone are insufficient:

• A tenant offers thousands of settings, and the default is designed to accommodate as many organizations as possible.
• The default prioritizes convenience over protection; for MFA and Conditional Access, the correct configuration depends, for example, on the tenant's region and access requirements.
• Many features purchased with a license are not activated or require additional configuration and training.
• New features are constantly being added and rolled out with default settings that may remain unused or insecure.

The Secure Score in the tenant shows how secure the environment is from Microsoft's perspective and should be checked regularly. A Tenant Check complements this with an assessment based on Baggenstos criteria.

The five building blocks of a secure Microsoft 365 configuration

Logins and Conditional Access

A second factor is a must today, but the method is equally decisive. SMS and phone calls are considered weaker methods; Microsoft is discontinuing SMS and voice verification in Microsoft Entra ID on February 1, 2027. Authenticator methods and, where possible, phishing-resistant methods like passkeys are recommended. With Conditional Access, you can additionally control who is allowed to access from where, for example based on location, user group, service account, or sign-in frequency. Depending on the license, suspicious sign-ins can be blocked automatically. The management of these rules is handled via Microsoft Entra and implements the principle of verifying every access, as we explain in the article Zero Trust in the enterprise describe.

Tenant settings

Default values are designed for an easy start, not for maximum security. Areas to review include permissions and connected applications in Entra, as well as data residency in Microsoft 365, external calendar and Teams participation, as well as sharing and external storage. SharePoint links should have an expiration date and not be open to anyone with the link. Regarding data residency, the speakers mentioned a setting that must be reviewed by December 14, 2026: it determines whether data may be stored within your own country or regionally within the EU and EFTA (as of October 2026).

Microsoft Defender for everyday protection

Microsoft Defender only provides protection if the services are licensed, activated, and correctly configured. Defender for Office 365 protects against phishing, malware, and malicious attachments and links; Defender for Endpoint protects laptops and smartphones; and Defender for Identity provides signals from hybrid Active Directory environments. Which features are available depends on your license and environment.

Governance for order and clear rules

Governance is intended to prevent oversharing—that is, too many people seeing too many files. This includes cleaning up old shares, orphaned Teams, and files without owners. User, service, and guest accounts, as well as administrator roles, should also be reviewed regularly; former employees should not retain any permissions. The speakers suggested annual or semi-annual checks as a guideline. For the classification and protection of confidential data, it is also worth taking a look at Microsoft Purview.

Making Shadow AI visible

Company data does not belong in AI tools that no one knows about. Therefore, transparency is needed regarding which AI applications are in use. These are evaluated, permitted use cases are defined, and risky applications can be blocked depending on the available Defender features. The data for this is provided by Defender for Endpoint (installed applications) and Defender for Cloud Apps (web usage), analyzed by application, user, or department. The goal is visibility, not monitoring individual people. How AI can be used productively and securely is also the topic of our event IT Early Bird. If you are planning your own AI agents, you will find the points regarding data and access in our article on Microsoft Copilot Studio .

Microsoft 365 security is an ongoing process

A one-time configuration is not enough in cyber security . New features, license dependencies, and the multitude of settings mean that the status is constantly changing. Secure Score, tenant audits, and other reviews should therefore take place on a recurring basis. Two points are often overlooked: automatic responses to attacks require appropriate licenses, and logs must be specifically activated. Depending on the license, Entra sign-in logs are only available for a limited time and can be forwarded to Log Analytics if necessary. Our article summarizes which additional organizational measures are important Cyber Security for SMEs: Measures 2026 together. If you are unable to perform the recurring checks internally, you can cover them as part of Managed Services cover them.

The free Tenant Security Check at a glance

The Tenant Security Check, referred to as a Tenant Security Assessment in the video, compares your tenant's existing settings and policies against defined benchmarks: Microsoft recommendations, industry standards, and Baggenstos' project experience. The report is therefore not based on a subjective assessment. Here is how it works:

1. Express your interest via the registration form
2. Baggenstos requests temporary read-only access, which an administrator at your company confirms via a link
3. The configuration is read; nothing in the tenant is changed
4. The report shows which points are in order for Entra, Microsoft 365, and Office 365, where there are warnings, and where there are errors, such as inactive Conditional Access rules or missing anti-malware policies
5. The measures are prioritized by urgency: high risks first, followed by governance and permission cleanup, and finally fine-tuning
6. The results are discussed in a roughly 30-minute meeting, including the most important areas for action

Sign up for the free Tenant Security Check now or book a consultation directly.

‍