Microsoft 365 Security: What Default Settings Don't Cover

Microsoft 365 is a secure platform — Microsoft invests enormously in protecting its infrastructure. But there's a line in every cloud contract that surprises business owners: the shared responsibility model. Microsoft secures the platform. Securing your configuration, your data, and your users is your job.

Here's where the defaults leave gaps.

Gap 1: Email threats that pass the built-in filter

Default filtering catches commodity spam. It is far weaker against targeted phishing, executive impersonation, and business email compromise — attacks crafted for your company specifically, often from legitimate (compromised) accounts that no reputation filter flags.

Closing it: dedicated Email Protection + App Security adds a detection layer built for these attacks — $4.50 per user per month at CyberOM.

Gap 2: Your data is not backed up

This one genuinely shocks people. Microsoft 365 has retention features, but it is not a backup service. If data is deleted — maliciously by ransomware, or accidentally — and retention windows pass, it's gone. Microsoft's own service agreement recommends third-party backup.

Closing it: Microsoft 365 Backup — $3.90 per seat per month — keeps independent, restorable copies of mail, OneDrive, SharePoint, and Teams data.

Gap 3: Nobody is watching the configuration

M365 has hundreds of security settings: conditional access, legacy authentication, mailbox forwarding rules, app consent. Attackers love forgotten settings — a single mailbox auto-forward rule created by an intruder can silently leak correspondence for months. The defaults won't alert you.

Closing it: M365 Security Management — $3.50 per M365 seat per month — continuous hardening and monitoring of the tenant configuration itself.

Gap 4: Your domain can be impersonated

Without DMARC enforcement, anyone can send email that claims to be from your domain — to your customers, your suppliers, your accountant. The default state of most domains allows it.

Closing it: DMARC Protection — $495.00 per domain per month — takes your domain to enforcement so impersonation attempts are rejected, not delivered.

The honest summary

A 20-user company can close all four gaps for roughly $12 per user per month plus $495 per domain — less than the cost of the coffee that gets spilled during one emergency recovery meeting. And if you want endpoints and 24/7 monitoring in the same decision, the managed packages start at $9.20 per endpoint per month.

FAQ

Doesn't my Microsoft license include security?

It includes platform security and baseline features. The gaps above — targeted email attacks, true backup, tenant hardening, DMARC enforcement — are your side of the shared responsibility model.

Can I buy just one of these?

Yes. Every service is individually priced in the store.

How does setup work?

Submit a request online; our team responds within 24 hours and handles configuration.

See M365 services and pricing →