The Microsoft 365 security gaps MSPs see most (and how to close them)

Ask a room full of MSPs what they see wrong in Microsoft 365 tenants and you'll hear the same list, over and over. Not exotic zero-days, but the same handful of gaps left open in tenant after tenant, usually because someone turned on the headline control, ticked the box, and never came back to finish the job. "We've got MFA" is the classic. It's true, and it's nowhere near enough.

In short: The Microsoft 365 gaps MSPs see most often are incomplete MFA coverage, Conditional Access left at defaults, session-token theft that walks straight through MFA, too many standing admins, oversharing across SharePoint and OneDrive, under-configured email authentication, unmanaged devices, and no real monitoring, plus a run of SMB-specific misconfigurations that generic enterprise checklists don't mention at all. Almost every one starts as a control someone switched on but never finished configuring, and closing them is mostly a matter of finishing the job. This checklist is scoped for the 15 to 250 seat band specifically, where there's rarely a dedicated security team to catch what a bigger enterprise would.

Here are the Microsoft 365 security gaps we and other managed service providers see most often, why each one matters, and how to actually close it.

Why a 15 to 250 seat business needs a different checklist

Most Microsoft 365 security guidance is written for one of two audiences: a home user, or an enterprise with a dedicated security team, a SOC and a budget line for each control. Almost none of it is written for the business in between, big enough to be a genuine target, small enough that "IT" is one generalist person or a small outsourced team juggling security alongside everything else.

That gap matters because the advice changes with it. An enterprise checklist assumes someone is watching Secure Score weekly, running quarterly access reviews as a formal process, and has a named person for each control. A 15 to 250 seat business usually has none of that as a dedicated function, security sits alongside helpdesk tickets, onboarding, and everything else IT does.

The fixes below are chosen and ordered with that reality in mind: what closes the most risk with the least ongoing overhead, using the licensing most businesses in this band already hold rather than a wishlist of enterprise add-ons.

Why isn't "we've got MFA" the finish line?

Multi-factor authentication is the single most valuable control in Microsoft 365, and almost everyone has some form of it now. The problem is the gap between some MFA and MFA that actually holds.

The gaps MSPs see constantly: MFA enabled for most users but not the service accounts and admins that matter most, legacy authentication protocols still enabled underneath it (which bypass MFA entirely), and basic app-password or SMS fallback that attackers can work around. Security Defaults are a good floor, but a floor is all they are, and in a 15 to 250 seat tenant they're often the only thing switched on because nobody had time to go further.

Checklist for this section:

• MFA enforced for every account, including admins, shared mailboxes and service accounts, not just standard users
• Legacy authentication protocols (POP, IMAP, older Exchange ActiveSync) blocked outright
• SMS and voice-call MFA phased out in favour of the Authenticator app as a minimum, moving toward phishing-resistant methods below
• Security Defaults replaced with Conditional Access once you have Entra ID P1 (included in Business Premium), because Defaults can't be tuned per-role

The fix is Conditional Access done properly: MFA enforced for everyone, legacy authentication blocked outright, and a move towards phishing-resistant methods (passkeys, Windows Hello for Business, FIDO2 keys) for privileged accounts. Which leads straight to the gap nobody wants to think about.

Token theft and AiTM: the attack that walks straight through MFA

This is the topic that dominates MSP security conversations right now, because it breaks the reassuring story that "MFA means we're safe." Adversary-in-the-middle (AiTM) phishing kits, which Microsoft's security researchers have tracked at scale, don't try to defeat MFA, they sidestep it.

The victim logs in and completes MFA on a real-looking proxy page, and the attacker captures the resulting session token. With that token, they're in, no second factor required, because from Microsoft's point of view the session is already authenticated.

Token theft is now one of the most common ways Microsoft 365 accounts get compromised, and standard MFA does nothing to stop it on its own. What does help: Conditional Access policies that bind sessions to compliant or hybrid-joined devices, shorter session lifetimes for risky sign-ins, token protection, and phishing-resistant MFA that can't be proxied in the first place. This is exactly why "we've got MFA" is no longer a complete answer.

Conditional Access: the baseline that closes both gaps at once

MFA coverage and token theft are really the same underlying problem: sign-in is treated as one binary check rather than something evaluated continuously against risk. Conditional Access is the control that fixes both, and for a 15 to 250 seat business it's usually already licensed (it's included from Business Premium and Entra ID P1 upward) but only partly configured.

A workable baseline, built and tested in this order so you don't lock yourself out partway through:

1. Block legacy authentication entirely, this alone closes one of the most common bypass routes, and it is usually safe to deploy first because so little legitimate traffic still needs it.
2. Require MFA for all users, with named break-glass accounts excluded and monitored separately.
3. Require a compliant or hybrid-joined device for access to email and files, so a stolen password or token is far less useful without the device behind it.
4. Apply sign-in risk policies that step up verification or block access outright when a sign-in looks unusual, a new country, an impossible travel pattern, a leaked credential.

Roll these out one policy at a time, in report-only mode first, and check who they would have blocked before switching to enforced. That single habit is what stops a Conditional Access rollout from becoming a Monday morning of locked-out staff. If you want the fuller policy-by-policy breakdown, we cover the complete baseline set in the Conditional Access policies every UK SMB should have on.

Privileged access: how many admins is too many?

Open almost any tenant that hasn't been professionally reviewed and you'll find more Global Administrators than there should be, admin accounts that are also someone's day-to-day mailbox, and no dedicated break-glass account for emergencies. Every one of those is an oversized target, and in a smaller business it's an easier mistake to make: with two or three people effectively running IT, it's tempting to just make everyone an admin rather than work out who actually needs what.

The pattern MSPs push towards: a small number of named admins, admin roles separated from everyday user accounts, just-in-time elevation with Privileged Identity Management (PIM, included from Entra ID P2, or a simplified manual review process where P2 isn't licensed) so standing access is minimised, and two carefully protected break-glass accounts excluded from the very policies that could otherwise lock everyone out.

Privileged access is where a single compromise does the most damage, so it's where the tightening matters most, and it's genuinely quick to fix once someone sits down and counts.

Oversharing and data governance: the gap Copilot just made urgent

SharePoint and OneDrive make sharing effortless, which is exactly the problem. Over years, "anyone with the link" permissions, stale external guests and unlabelled sensitive files accumulate quietly. It was always a risk. Microsoft 365 Copilot turned it into an urgent one, because Copilot surfaces anything a user can already access, instantly and at scale.

Closing it means auditing sharing links and external access, applying sensitivity labels to genuinely sensitive data, tightening default sharing settings, and running an oversharing review before Copilot goes live rather than after. We wrote a whole Copilot readiness checklist because this single gap catches so many businesses out, whether or not Copilot is on the roadmap yet.

Email: still the front door, still under-configured

Email remains the number one route in, and Microsoft 365's defaults, while decent, are rarely tuned. The recurring gaps: SPF, DKIM and DMARC not fully configured (so spoofing your own domain is easy), anti-phishing policies left at default, no impersonation protection for the finance team and executives who get targeted by business email compromise, and inbound rules nobody reviews.

Checklist for this section:

• SPF, DKIM and DMARC all published and set to actually enforce, not just monitor
• Anti-phishing policies tuned beyond the Microsoft default, with impersonation protection on named executives and finance staff
• Inbound mail-flow rules audited for anything that silently forwards, redirects or auto-deletes, a classic sign of an already-compromised mailbox
• A layered email security product sitting in front of or alongside Exchange Online Protection, particularly for businesses without a dedicated security analyst reviewing quarantine daily

Layered email security, impersonation protection and proper authentication records turn the front door from "ajar" into "locked". This is exactly the gap our Email Security service is built to close, sitting alongside the wider Security Services rather than replacing what Microsoft already gives you.

Devices: unmanaged endpoints quietly undermine everything

You can harden identity and data perfectly and still lose it all through a device you don't control. Half-finished Intune rollouts are everywhere: some devices enrolled, some not, compliance policies created but not enforced through Conditional Access, and personal devices accessing company data with nothing standing behind them.

An unmanaged laptop is a laptop that can't be patched, encrypted or wiped on demand. Enrolment, real compliance policies, and Conditional Access that actually requires a compliant device are what turn device management from paperwork into protection. Our Intune device management checklist walks through exactly that.

Monitoring: the gap you don't see until you need it

The quietest gap of all is the one MSPs find during an incident: nobody was watching. The unified audit log switched off or never queried, alerts firing into an inbox no one reads, Secure Score sitting at a number nobody's acted on, and no 24/7 eyes on the tenant at all. Detection and response is what turns a security event at 2am into a contained incident rather than a Monday-morning discovery.

Continuous monitoring, tuned alerting, and someone actually on the end of it are the difference between knowing and hoping, and for most businesses in this band, that "someone" needs to be an outsourced service rather than an internal rota, because 2am coverage from a five-person IT team isn't realistic.

The SMB-specific misconfigurations that don't show up on enterprise checklists

These are the gaps that are specific to the 15 to 250 seat reality, growing fast, thinly staffed on IT, and usually inherited rather than deliberately built, rather than generic security advice copied from an enterprise framework.

• New starters cloned from an existing user's access rather than assigned by role, so permissions creep sideways with every hire until nobody can say why a given person can see what they see.
• A personal Microsoft account still holding admin rights left over from when the business first set up its tenant, years before anyone thought about access governance.
• Shared or generic mailboxes (info@, accounts@, sales@) with weak or no MFA, because they're technically shared resources rather than someone's named login, and get forgotten in every MFA rollout.
• No documented joiner-mover-leaver process, so leavers' accounts and access linger for weeks or months after they've actually left, found only when someone happens to audit the user list.
• A free or consumer antivirus running alongside Defender for Business, left over from before the Microsoft 365 upgrade, quietly conflicting with it or giving a false sense of extra coverage.
• Licensing bought for a bundle's headline features, with the included security tooling never turned on. Business Premium in particular already includes Defender for Business, Conditional Access and Intune, and a large share of tenants running it are paying for controls that sit switched off.
• No accountable owner for security decisions at all. In a bigger business this sits with a CISO or IT manager; in a 15 to 250 seat business it's frequently nobody's explicit job, which means every item on this list waits for an incident to force the conversation.

The common thread: switched on isn't the same as finished

None of these gaps come from neglect exactly. They come from good intentions that stopped at the headline setting: MFA enabled but not enforced everywhere, Intune rolled out but not enforced, Copilot switched on before the data was ready, alerts configured but never watched.

Real Microsoft 365 security is layered, identity, access, email, data, devices and monitoring, and it's only as strong as the layer someone forgot to finish. That's doubly true at 15 to 250 seats, where there usually isn't a specialist for each layer, just a small team of specialists covering all of them at once.

Where this leaves you

If any of this sounds like your tenant, you're in good company, it describes most Microsoft 365 environments we assess in this size band. The good news is that every gap here is fixable, usually faster and cheaper than businesses expect, once someone actually looks, and most of it uses licensing you already hold rather than requiring a new purchase.

Systech's Security Services bring Managed Firewall, EDR, XDR and 24/7 threat management together with proper Microsoft 365 hardening, and our Email Security service closes the front-door gaps above specifically. It starts with a Microsoft 365 Security Posture Assessment that scores exactly where you stand across identity, data, device and threat protection, so you fix the gaps that matter first, on your own schedule rather than an attacker's.

And if you need to prove these controls exist to a customer, an insurer or an assessor rather than just having them in place, our Compliance Packs service turns this same checklist into audit-ready evidence.