In this article
In Microsoft 365, Microsoft protects the data centres, servers, physical network and the service's operating system; the business remains responsible for its data, accounts, access and users' devices. Microsoft says so itself in its official documentation. That is why the line "our data is in Microsoft 365, so it's safe" — the one we hear most often in assessments — gets the building right and the keys wrong. This article sets out the split of responsibilities and the ten controls that belong to your organisation.
Summary for the board
- Four responsibilities are yours Data, accounts, access and devices.
- The risk lies in configuration Most incidents stem from accounts without MFA, open sharing or former staff who still have access, not from Microsoft failures.
- 99.9% According to Microsoft, MFA and blocking legacy authentication stop more than 99.9% of common account attacks.
- Quarterly review A 10-point checklist covers the essentials.
Who is responsible for each layer
Microsoft distinguishes three types of cloud service. In software as a service (SaaS) — Exchange Online, OneDrive, SharePoint and Teams — it takes on almost the entire technical stack. But in every model the customer owns its data and its identities.
| Layer | Responsible | In practice |
|---|---|---|
| Data centres, servers and physical network | Microsoft | Power, cooling, hardware faults, physical security |
| Operating system and network controls of the service | Microsoft | Server updates and platform protection |
| Application configuration | Shared | Microsoft maintains the software; the business decides how it is configured |
| User devices | Shared, protection handled by the business | Laptops and phones kept updated, encrypted and protected |
| Accounts and access | Business | Creating and removing accounts, MFA, permissions, conditional access |
| Data | Business | Classification, encryption, retention and compliance |
An analogy helps: Microsoft is the landlord of a very well guarded building, with a concierge, cameras and solid walls. The key to your office, the list of who may use it and what is left on the desk are your decisions. If you hand out copies of the key, the concierge has no way of knowing.
Control 1: identity is the new perimeter
In the past, getting to the files meant getting into the office network. In Microsoft 365, all it takes is an email address and a password, from any computer in the world.
Microsoft's security defaults, at no additional cost, require every user to register for MFA (usually an approval on their phone), prompt administrators for MFA at every sign-in and block legacy authentication protocols. They are switched on by default in many tenants created since 22 October 2019, but not all — and some organisations have turned them off "because they were a nuisance". The alternatives are explained in our guide to multi-factor authentication in the business.
Three questions that should be answerable in minutes:
- Global administrators — how many are there? There should be two or three, not ten.
- MFA coverage — do all accounts, including shared and service accounts, have MFA or are they blocked from signing in?
- Leavers — have the accounts of everyone who left in the last 12 months been disabled?
Control 2: external sharing by decision, not by default
According to Microsoft, external sharing is enabled by default in SharePoint and OneDrive for the whole organisation. Collaborating with clients and partners is useful, but it should be a conscious decision.
The critical point is "Anyone" links: whoever receives the link opens the file without signing in, and a forwarded email takes the file with it.
- Anonymous links Disable them or enforce an expiry date.
- Guests Share only with people who authenticate.
- Sensitive sites Close external sharing on finance, HR and management sites.
- Review Clean up the list of external guests every quarter.
Email deserves its own attention: automatic forwarding to outside addresses, rules created by attackers and domains that are easy to spoof. See what goes wrong with email security in Microsoft 365.
Control 3: devices and data
An unencrypted laptop left in a taxi with Outlook and OneDrive synchronised is a data leak on wheels. Microsoft does not manage it: the documentation assigns the protection of devices accessing the services to the customer. That means an encrypted disk, an up-to-date operating system, managed antivirus and, ideally, rules that block non-compliant devices.
For data, there are two decisions for the business: what is confidential and who can see it, and how long it is kept. Backup is part of the second, and it is not included in the way many people assume — we explain why in Microsoft 365 backup for businesses. Some protections depend on the licensing plan, as shown in Microsoft 365 licences and security for SMEs.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
The 10 quarterly controls
| # | Control | Frequency |
|---|---|---|
| 1 | MFA enabled on every account, with no forgotten exceptions | Monthly |
| 2 | Legacy authentication blocked | Once; confirm quarterly |
| 3 | Global administrators kept to a minimum, with accounts separate from day-to-day use | Quarterly |
| 4 | Former employees' accounts disabled on their last day | At every departure |
| 5 | "Anyone" links disabled or set to expire | Once; review quarterly |
| 6 | External guests reviewed | Quarterly |
| 7 | Automatic email forwarding to external addresses blocked | Once |
| 8 | Laptops and phones encrypted, updated and managed | Monthly |
| 9 | Independent backup with restore testing | Quarterly |
| 10 | Audit logs enabled and alerts for suspicious sign-ins | Continuous |
Real case: Massamá and Monte Abraão
At the União das Freguesias de Massamá e Monte Abraão, DataRoad migrated around 50 mailboxes to Exchange Online, with their history and folder structure. After the migration, workstations and mobile devices were reconfigured and validated, with email, calendar and contacts syncing without errors. For a public body, the cloud also brought greater control, retention and auditing of email. The project is described in Microsoft 365 migration in Massamá and Monte Abraão.
How DataRoad takes on this part
Administration of Microsoft 365 for businesses — accounts, MFA, sharing and devices — is included in the IT Unlimited plans. On IT Unlimited Essential, from 10 workstations, support is remote and by telephone, which covers almost all of these tasks; on-site visits are not included.
Frequently asked questions
If a company account is attacked, is Microsoft liable?
As a rule, no. Under the shared responsibility model, accounts, access and MFA belong to the customer. Microsoft protects the platform; anyone who signs in with a stolen password is using the door the business controls.
Are the security defaults enough?
For many SMEs they are a good start and carry no additional cost. With licences that include conditional access you can go further, for example by requiring a managed device or blocking sign-ins from certain countries.
Does restricting external sharing get in the way of working with clients?
Not if it is well calibrated: sharing with authenticated guests, anonymous links blocked or restricted, and external sharing closed only on sensitive sites.
How often should the configuration be reviewed?
A full review every quarter and a quick check whenever someone joins or leaves. Configuration changes without warning: new features, new guests, new exceptions.
Next step: a Microsoft 365 security review in 5 working days
We check accounts, MFA, administrators, external sharing, forwarding rules, devices and backup, and deliver the fixes ranked by risk. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
