Is Microsoft 365 not secure enough?

Oct 13, 2026 (updated on Nov 10, 2026)

In this article: why the features are certainly there but rarely configured right, what a recent tenant review at a customer uncovered, and which foundation an SME really needs.

The question sounds logical. You pay Microsoft a fair price per user per month. Especially with Business Premium, a complete security package comes in the box: Defender, Intune, Entra ID, Conditional Access, it is all included.

So: secure enough, right?

The honest answer: the capability is there. The guarantee is not.

Security is a setting, not a product

Microsoft delivers the features, but does not switch them on by itself. Conditional Access is there, but someone has to put policy in it. MFA can be enforced, but nobody has enforced it, so nobody uses it. Defender for Office 365 filters phishing, but how strictly the filters work depends on how they are configured.

We regularly scan the M365 environments of SMEs. Without exception we find settings that are slightly outdated or slightly too loose. Open legacy authentication, administrator accounts without MFA, guest access that was never cleaned up, devices that are not in any compliance policy. None of this is the fault of the person responsible for IT. Nobody was simply paid to look at it every week.

From the field: everything present, little switched on

Take a recent review at a customer, a company with about a hundred employees. Business Premium, so the full security stack in the house. What did we find? Not a single ASR rule active: the attack surface reduction rules that block ransomware and credential theft in their first seconds were all off. Defender for Office 365 ran on its out-of-the-box settings: the filters did something, but nobody had ever tightened them. Malware ZAP was off, high-confidence phishing got no automatic action, and automatic forwarding of e-mail to external addresses was blocked nowhere. The pattern was clear. What had once been configured manually still worked. Everything nobody had ever switched on sat on the factory settings.

At such a moment Microsoft Secure Score is the most honest yardstick. That score is not an arbitrary points list, but a series of recommendations that Microsoft draws up from how real attacks have actually played out: which technique did the attacker use, through which door did he come in, which setting could have stopped him. Every point you leave behind stands for an approach that has actually worked somewhere. A low score does not mean you miss a grade. It means the recipes of recent, successful attacks are still open to you.

The foundation is cheap, and often missing

What really counts for an SME is not a 24/7 SOC or an army of analysts. The foundation: MFA enforced everywhere, no eternal administrators, devices that comply with the rules, a backup outside Microsoft, someone who keeps watching. That is the difference between the foundation and the overhead of a security department. Banks are expensive because of the overhead, not because of the ten things that really matter. How you build that foundation step by step is in our step-by-step plan for a secure workplace.

Microsoft, by the way, has no interest in simplifying that. The licence grid is full of options that sound almost the same, and the responsibility to configure everything correctly lies entirely with the customer. That is in the fine print.

The test that tells you something in two seconds

Want to taste how we work without an appointment? Run the free e-mail scan. It checks live whether someone can send mails that look as if they come from your domain. Spoofing is the cheapest attack there is, and the scan shows immediately whether your domain is open.

Looking further than e-mail does not require half a day of reading. Our Security Audit puts more than 200 parameters next to CyberFundamentals, the official Belgian framework. You do not get a list, you get a verdict: what stands well, what is urgent, what you consciously accept.

You know where you stand within a few days, no more guessing. Or first test for free whether your e-mail domain can be spoofed: the email scan takes 2 seconds.