Security in the cloud: what Microsoft protects and what remains your responsibility

7 min read · DataRoad

Security in the cloud It’s a shared responsibility: Microsoft guarantees the infrastructure, your company guarantees who enters, what they share and where they access it. Microsoft doesn’t hide it — it publishes it in the official documentation. “Our data is in Microsoft 365, so it’s safe” is the phrase we hear most often in diagnostic meetings. It’s right about the building. It’s wrong about the keys.

The model of shared responsibility, in plain English

Microsoft describes three types of cloud service. In the most comprehensive one — software as a service, or SaaS, where Exchange Online, OneDrive, SharePoint, and Teams are included — Microsoft takes on almost the entire technical stack. But there is a phrase that applies to all types: the customer always owns their data and their identities.

Identity: the new front door

In the traditional office, to access files you had to connect to the network. In Microsoft 365, you only need an email address and a password, from any computer in the world. Identity has become the front door.

Microsoft offers so-called security presets at no additional cost: they require all users to register MFA (the second factor, usually a mobile approval), require MFA for administrators at every login, and block legacy authentication protocols that do not support MFA. They are turned on by default on many accounts created since October 22, 2019, but not on all of them — and some have turned them off “because they were annoying.” According to Microsoft, MFA and blocking legacy authentication thwart more than 99.9 percent of common identity attacks. We detail the options in MFA: multi-factor authentication in the company.

Three questions that the administration must be able to answer in minutes:

• How many accounts have global administrator rights? (There should be two or three, not ten.)
• Do all accounts — including shared and service accounts — have MFA or are they locked for login?
• Are the accounts of those who left in the last 12 months deactivated?

Configuration and external sharing

According to Microsoft documentation, external sharing is turned on by default in SharePoint and OneDrive for the entire organization. This is useful — working with customers and partners is the goal — but it has to be decided, not inherited.

The most sensitive point is the “Anyone” type links: anyone who receives the link opens the file without logging in. If that email is forwarded, the file will be downloaded afterwards. In practice, we recommend:

• Disable the “Anyone” links or, if necessary, impose an expiration date.
• Allow sharing only with guests who authenticate themselves.
• Restrict external sharing on sites with sensitive data (financial, human resources, administration).
• Review quarterly the list of external guests and remove those who no longer work with the company.

The email configuration deserves its own chapter — automatic forwardings to outside addresses, mailbox rules created by attackers, a domain easy to imitate. We covered the topic in Email security in Microsoft 365: what fails.

Devices and data

A laptop without a password, forgotten in a taxi, with Outlook and OneDrive synchronized is a data leak on wheels. Microsoft does not manage this laptop: the documentation explicitly states that the protection of the devices accessing the services is the customer’s responsibility. This means disk encryption, updated system, managed antivirus, and ideally rules that prevent access from devices that do not meet these requirements.

As for the data, there are two decisions that fall to the company: what is confidential (and who can see it) and how long it is kept. Backup is part of this second decision — and it isn’t included as many people think. We explain why in Microsoft 365 doesn't store everything. Licenses also count: certain protections only exist in certain plans, as we explained in Microsoft 365 licenses and security.

Checklist: the part that is yours

A real case: 50 mailboxes migrated to Office 365

In the Union of the Parish of Massamá and Monte Abraão, DataRoad migrated about 50 mailboxes to Exchange Online, including the history and organization of the folders. The project did not end with the migration: workstations and mobile devices were reconfigured and validated, with email, calendar, and contacts being correctly synchronized. In a public entity, the transition to the cloud was also a way to strengthen email control, retention, and auditing. Read the case study Migration to Office 365 in Massamá and Monte Abraão.

At DataRoad, the management of Microsoft 365 for business — accounts, MFA, shares, devices — is part of the IT Unlimited plans. No Essential plan, Starting from 10 positions, the support is remote and telephone-based, which covers almost all of these tasks; the travel to the site is budgeted separately.

Frequently Asked Questions

Is Microsoft responsible if a my company account is attacked?

As a rule, no. According to Microsoft's shared responsibility model, accounts, access, and MFA are the customer's responsibility. Microsoft is responsible for the security of the platform; anyone who enters with a stolen password enters through the door that the company controls.

The security presets are arriving?

For many SMEs they are a good starting point and do not have additional costs. Companies with licenses that include conditional access gain finer rules — for example, requiring managed equipment or blocking login attempts from certain countries.

Disabling external sharing won't interfere with working with clients?

It is not necessary to disable everything. The usual balance is to allow sharing with authenticated guests, block or limit anonymous connections, and only close external sharing on websites with sensitive data.

How often should we review the configuration?

A full review every quarter and a quick check whenever someone enters or leaves the company. The cloud setup changes without anyone noticing: new features, new guests, new exceptions.

Microsoft 365 security review in 5 working days

We checked the parts that are yours — accounts, MFA, administrators, external shares, redirects, devices, and backups — and delivered the list of fixes in order of risk. For companies with more than 10 seats · contract of assistance · remote, on-site, and telephone support.

Sources

• Microsoft Learn — Shared responsibility in the cloud
• Microsoft Learn — Security defaults in Microsoft Entra ID
• Microsoft Learn — Overview of external sharing (SharePoint and OneDrive)