Most Microsoft 365 security gaps are identity gaps. Not sophisticated attacks. Not zero-day exploits. Stolen credentials, permanent admin accounts, abandoned user accounts, and weak MFA methods. This guide covers the five identity checks that reveal the most risk in the shortest time — and what to do about each.
Microsoft's own Security Intelligence Report consistently finds that over 99% of identity attacks rely on password spray, phishing, or credential stuffing — not technical exploits. The target is always the same: a valid account that can be authenticated without additional friction.
The good news is that these attacks are preventable. The bad news is that preventable doesn't mean prevented — and most tenants, even well-managed ones, have at least one of the five gaps below.
The most common identity check is "do you have Conditional Access policies?" The more useful question is "what are your CA policies actually enforcing — and what are they missing?"
A tenant can have 10 CA policies and still have critical gaps. The 8 controls that matter most:
M365Clarity produces a CA governance score (0–100) from these 8 controls, derived from your actual tenant configuration — not a self-assessment.
Permanent role assignments mean your Global Administrators have elevated access 24 hours a day, 7 days a week — even when they're not performing admin tasks. If their account is compromised, the attacker immediately has Global Admin access with no additional steps.
PIM converts permanent assignments to eligible (just-in-time) ones. When a user needs admin access, they request it, complete an MFA step-up (and optional manager approval), and receive time-limited access — typically 1–8 hours. When the window expires, access is removed automatically.
The common state we see in first scans:
The risk isn't just external. Insider threat scenarios — former employees, contractors with ongoing access — are significantly harder when roles require activation rather than being permanently held.
Which roles to prioritise: Global Administrator (highest risk), Exchange Administrator, SharePoint Administrator, Teams Administrator, Intune Administrator, Security Administrator. Any role that can manage other accounts or access production data should be JIT by default.
Microsoft Entra ID Protection runs continuously in the background of every Entra ID P2 tenant, analysing sign-in patterns and credential exposure. When it detects a risk signal, it flags the user as medium or high risk. Most IT teams never look at this dashboard.
Risk signals include:
A high-risk user with leaked credentials should have their password reset and MFA re-registered immediately. If your CA sign-in risk policy is configured (check 1 above), this triggers automatically. Without a risk policy, it's a manual process you may not know you need to do.
High-risk users require immediate action. The presence of a high-risk user in your tenant means Entra believes that account may be compromised right now. Don't let this sit unreviewed.
Having MFA enabled is table stakes. Understanding which methods your users are actually using is the question that reveals real risk.
| Method | Phishing resistant | Risk level |
|---|---|---|
| FIDO2 / Passkey | Yes | Strongest |
| Windows Hello for Business | Yes | Strongest |
| Microsoft Authenticator (push + number matching) | Near-phishing-resistant | Strong |
| TOTP authenticator app | No | Medium |
| Email OTP | No | Medium |
| SMS / Voice call | No | Weakest — SIM-swap vulnerable |
The specific risk with SMS: SIM-swap attacks allow an attacker to redirect a victim's phone number to a SIM they control, receiving all SMS messages including OTP codes. This is not theoretical — it's the mechanism behind high-profile account takeovers at major companies.
Admin accounts using SMS-only MFA deserve immediate attention. Use Authentication Strength policies in CA to require phishing-resistant MFA for admin roles specifically, without forcing it on all users at once.
A user who left the company six months ago. A contractor whose engagement ended. A shared account that hasn't been used since a project completed. These accounts still exist, still have passwords (that were set at onboarding and may match a password in a breach database), and still have access to Microsoft 365.
The risk is not the licence cost — that's a secondary concern. The risk is that these accounts are valid credentials that an attacker can use, and because nobody is actively using the account, a compromise might go unnoticed for months.
Common stale account patterns:
The fix is straightforward: disable (not immediately delete) accounts inactive for 60–90 days. After 90 days with no recovery request, delete. For service accounts, document their purpose and owner, set an expiry, and monitor with alerts. Entra Lifecycle Workflows can automate this on offboarding triggers.
These five checks give you a structured way to open the identity security conversation with clients who think they're "covered" because they have MFA. The CA governance score in particular is useful — a score of 38% means MFA is on, but 5 of 8 best-practice controls are missing. That's a concrete, defensible statement rather than a subjective opinion.
The PIM check is the strongest conversation starter for clients who haven't engaged with identity governance. "Your Global Admins have permanent access 24/7 — if any of them are compromised, an attacker has immediate full tenant control" is a statement that lands with non-technical stakeholders in a way that "you should enable MFA" does not.
M365Clarity for MSPs scans identity configuration across all client tenants — CA governance score, PIM assignments, at-risk users, auth method breakdown, and stale accounts. Spot gaps across your entire portfolio before clients ask why they were breached. Start an MSP trial.
M365Clarity scans your Microsoft 365 tenant and produces a CA governance score, PIM role breakdown, at-risk user list, auth method breakdown, and stale account list — automatically, from a single scan. Free to try on your own tenant.
Run a free scan →Related articles