--- title: "Microsoft 365 security | DataRoad IT" description: "Microsoft secures the platform; the company answers for accounts, MFA, sharing and laptops. The 10 Microsoft 365 controls. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/ source: https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Microsoft secures the platform; the company answers for accounts, MFA, sharing and laptops. The 10 Microsoft 365 controls. No-obligation proposal. # Microsoft 365 security: the 10 controls that are yours At a glance For decision-makers short on time. - 01 Microsoft protects data centres and the platform; data, accounts, access and devices are yours. - 02 Most incidents stem from configuration: accounts without MFA, open links, active ex-staff. - 03 Microsoft says MFA plus blocking legacy authentication stops over 99.9% of account attacks. - 04 DataRoad reviews 10 controls every quarter; the initial review takes 5 working days. ### In this article A compromised administrator account in Microsoft 365 opens up the board's email, the contracts in SharePoint and the HR folders, within minutes and from any country. **Microsoft 365 security** is split into two halves: Microsoft guards the infrastructure; your organisation is responsible for the data, identities, permissions and the devices your people use. It is written in Microsoft's own official documentation. The idea that "it's in the cloud, so it's protected" is right about the platform and wrong about everything else. Here is the exact split and the ten controls that fall to you. ## What does the board need to know in 30 seconds? - **Four fronts belong to the business** Information, identities, permissions and devices. - **The threat lives in the configuration** Accounts without MFA, public links and active former employees cause more damage than any Microsoft failure. - **More than 99.9%** The share of common account attacks that Microsoft says are stopped by MFA plus blocking legacy protocols. - **Ten quarterly checks** Enough to cover the essentials. ## Who is responsible for each layer of the service? Microsoft recognises three cloud service models. In SaaS, where Teams, SharePoint, OneDrive and Exchange Online live, it takes on almost the entire technical component. Even so, in every model, information and identities always belong to the customer. | Layer | Who is responsible | Concrete examples | | --- | --- | --- | | Buildings, servers and physical cabling | Microsoft | Power, cooling, hardware replacement, physical security | | Platform system and service network | Microsoft | Server patching, infrastructure defence | | Application configuration | Shared | Microsoft updates the software; the business chooses the settings | | Laptops and mobile phones | Shared, with protection on the business side | Updates, disk encryption, antivirus | | Identities and permissions | Business | Opening and closing accounts, MFA, conditional access, rights | | Information | Business | Classification, encryption, retention periods, compliance | Think of a top-tier office building: security at reception, CCTV, solid walls. That is Microsoft's role. Who gets a copy of the key to your floor and what is left lying on the desk is down to you. If the copies circulate, reception will never know. ## Why is identity the new line of defence? In the past, reaching documents meant being inside the office network. Today all it takes is an email address and a password, on any computer connected to the internet. Microsoft's security defaults, at no extra cost, force every user to register MFA (usually approving a prompt on their phone), require MFA for every administrator session and shut off legacy authentication protocols. Many tenants created from 22 October 2019 already have them switched on, though not all, and we often find organisations that disabled them because they were "a nuisance". The options are set out in our guide to [MFA for businesses](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). Three answers your team should be able to give within minutes: - **How many global administrators are there?** The right number is around two or three, never ten. - **Do all accounts have MFA?** Including shared mailboxes and service accounts, or else they are blocked from signing in. - **Can people who left still get in?** Accounts of anyone who left the company in the last year must be disabled. ## Was external sharing chosen or inherited? Microsoft states that, out of the box, SharePoint and OneDrive allow sharing outside the organisation. Working with clients and partners this way is practical, provided it is a decision and not an accident. The main danger lies in "Anyone" links: they open the document without authentication, and every forward carries it further. - **Anonymous links** Switched off or given an expiry date. - **Guests** Access only for those who sign in. - **Critical areas** No external sharing for finance, HR and the board. - **Clean-up** The list of external guests reviewed every quarter. Email has its own risks: automatic forwarding to outside addresses, rules planted by attackers, domains that are easy to spoof. Details in [where email protection fails in Microsoft 365](https://www.dataroad-it.com/en/microsoft-365-email-fraud-managed-security/). ## Who protects laptops and information? Picture a laptop without disk encryption, with Outlook and OneDrive synced, left on the back seat of a taxi: it is a data leak with a battery. Microsoft does not manage it; the documentation places device protection on the customer's side. That requires an encrypted disk, an up-to-date system, managed antivirus and, ideally, policies that block non-compliant devices. When it comes to information, the business has two choices to make: which information is confidential and who can see it; and how long it is kept. Backup is part of the second and, contrary to what many assume, it is not included. We explain why in [Microsoft 365 backup](https://www.dataroad-it.com/en/managed-microsoft-365-backup-recovery-windows/). Some protections depend on the licence; see [Microsoft 365 licensing and security for SMEs](https://www.dataroad-it.com/en/managed-microsoft-365-sme-licences-backup/). ## Which ten controls do we review every quarter? | # | Check | Frequency | | --- | --- | --- | | 1 | MFA on 100% of accounts, with no forgotten exceptions | Monthly | | 2 | Legacy authentication protocols blocked | Once, confirmed quarterly | | 3 | Global administrators kept to a minimum and separate from day-to-day accounts | Quarterly | | 4 | Leavers' accounts disabled on the day they leave | At every departure | | 5 | "Anyone" links switched off or time-limited | Once, reviewed quarterly | | 6 | External guests reviewed and cleaned up | Quarterly | | 7 | Automatic forwarding to outside addresses blocked | Once | | 8 | Mobile devices and laptops with encryption, updates and central management | Monthly | | 9 | Independent backup with restore test | Quarterly | | 10 | Auditing enabled and alerts for suspicious sign-ins | Continuous | ## How did it go at a public body? Around 50 mailboxes at the União das Freguesias de Massamá e Monte Abraão were moved by DataRoad to Exchange Online, keeping their history and folder structure. Once the move was complete, workstations and phones were reconfigured and validated, with email, calendar and contacts syncing without errors. The organisation also gained control, retention and auditing over its email. The full project is in [the parish council case: migrating email to the cloud](https://www.dataroad-it.com/en/massama-monte-abraao-exchange-online-migration/). ## What does DataRoad take on, and in which plan? Management of [Microsoft 365 for business](https://www.dataroad-it.com/en/microsoft-365-management/), covering identities, MFA, sharing and devices, is included in the IT Unlimited plans. In [IT Unlimited Essential](https://www.dataroad-it.com/en/it-unlimited-essential-remote-managed-it/), designed for organisations from 10 workstations, support is remote and by phone and covers almost all of these tasks, without site visits. ## Frequently asked questions ### Does Microsoft take the blame if one of our accounts is breached? As a rule, no. Accounts, access and MFA are the customer's responsibility; an intruder with stolen credentials comes in through a door the business controls. ### Is switching on security defaults enough? For many SMEs, it is a solid starting point at no extra cost. Licences with conditional access let you require managed devices or refuse sign-ins from certain countries. ### Does restricting external sharing get in the way of working with clients? No, if the rule is well tuned: authenticated guests, anonymous links cut or limited, and blocking only in sensitive areas. ### How often should the review happen? A full review every three months and a brief check whenever someone joins or leaves, because new roles, guests and exceptions change the configuration without warning. ## Next step: your Microsoft 365 audited in 5 working days We analyse accounts, MFA, administrators, sharing, forwarding, devices and backups, and deliver fixes in order of risk. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call **+351 211 459 950 *** or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Sources - [Shared responsibility in the cloud (Microsoft documentation)](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility) - [Entra ID security defaults (Microsoft documentation)](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) - [External sharing in SharePoint and OneDrive (Microsoft documentation)](https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)[Managed IT and cybersecurityManaged backup: the 30-minute restore test that proves itA backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Nobody notices security until the day it fails. That is why ours works every day: alerts handled, access reviewed, backups verified. - **11** years in business, since 2015 - **Top 5%** SMEs · scoring.pt - **5 ★** on Google · 52 reviews We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/