Why Every Australian Business Needs a Microsoft 365 Security Assessment
Key Takeaways
- Microsoft 365 security depends on how your environment is configured, managed and reviewed.
- A Microsoft 365 security assessment can identify weaknesses across identity, email, access, applications and data.
- MFA, Conditiona`l Access, Entra ID, Exchange, Teams, SharePoint, OneDrive and Defender all deserve attention.
- Your security review should prioritise business risk rather than simply produce a long list of technical findings.
- Regular reviews become more important as your users, applications and cloud environment change.
Introduction
You probably use Microsoft 365 every day for email, Teams, files, meetings and business documents. But here’s the thing: using Microsoft 365 does not automatically mean your business has a secure Microsoft 365 environment.
As your team grows, people change roles, new applications are added, and more information moves into the cloud. Security settings that once made sense may no longer be enough.
The 2024-25 financial year statistics from the Australian Communications and Media Authority (ACMA) show that the ACMA’s Australian Cyber Security Centre (Australian Cyber Centre) received over 1200 cyber security reports. The average cost to businesses for cybercrimes reported was $56,600 for small and $97,200 for medium businesses.
What Is a Microsoft 365 Security Assessment?
A Microsoft 365 security assessment is a systematic review of your Microsoft 365 environment to locate security gaps.
It can cover identity and access, email, collaboration tools, data protection, logging and security configurations.
There is an important difference between having a security feature and having that feature configured correctly. For example, your organisation may have multi-factor authentication available, but an assessment can check whether it is enforced for all users and privileged accounts.
This is also why Office 365 security should not be viewed as only an email issue. Your Microsoft environment can contain customer records, financial information, internal documents, intellectual property and sensitive communications.
Why Australian Businesses Should Take Microsoft 365 Security Seriously
Cybercriminals do not only target large enterprises. The latest ASD Cyber Threat Report found that SME owners experienced high rates of cybercrime, with 22% of SME respondents in the Australian Cybercrime Survey saying their business was impacted by cybercrime in 2024.
For a growing business, common risks can include:
- Stolen user credentials
- Phishing and malicious emails
- Excessive user permissions
- Uncontrolled guest access
- External file sharing
- Compromised administrator accounts
- Poorly managed applications
- Outdated authentication methods
There is also a data protection issue. Where the Australian Privacy Principles apply, APP 11 requires entities to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
What this really means is simple: your Microsoft 365 security settings should reflect the information your business holds and the risks it faces.
What Does a Microsoft 365 Security Assessment Check?
A useful assessment should look beyond one application.
Area | What we should check |
Entra ID | MFA, privileged accounts, inactive users, guest access and Conditional Access |
Exchange | SPF, DKIM, DMARC, forwarding, email encryption and audit logging |
Teams | External users, anonymous meetings, shared channels and approved apps |
SharePoint & OneDrive | External sharing, guest access, file permissions and link settings |
Defender | Phishing protection, alerts, malware controls and incident response |
Purview | DLP, information protection and retention policies |
These areas are consistent with the published Microsoft 365 assessment scope from Borderless CS, which includes Entra ID, Teams, Exchange, SharePoint Online, OneDrive, Defender, Purview and Edge, alongside MFA, Conditional Access and other security controls.
Five Microsoft 365 Checks You Can Make Today
Before arranging a formal assessment, you can start with a basic review.
1. Check privileged accounts.
When was the last time this account was used? Who has the account?
2. Review MFA.
Confirm MFA is enforced across users, especially privileged accounts.
3. Review external sharing.
Check who can access SharePoint and OneDrive files from outside your organisation.
4. Review email protection.
SPF, DKIM, DMARC, forwarding and auditing rules, as well as phishing protection, should be reviewed.
5. Review inactive accounts.
Former employees and other inactive accounts should be disabled.
These checks reflect several of the controls included in Borderless CS’s published Microsoft 365 security assessment approach.
A Practical Example: When Growth Changes Your Risk
Imagine your 60-person business has used Microsoft 365 for several years.
During that time, you hired contractors, created new Teams sites, added cloud applications and gave external partners access to selected files. Nothing unusual happened, so it is easy to assume the original security setup is still suitable.
But the business has changed.
An assessment may identify old accounts, excessive permissions, external sharing settings or Conditional Access policies that no longer match the way your organisation works.
That does not mean Microsoft 365 itself has failed. It means your environment has changed and your security controls need to catch up.
That distinction matters.
When Should You Assess Microsoft 365 Security?
You do not need to wait for a cyber incident.
Consider an assessment when:
- Your business has grown quickly.
- You have moved more systems into Microsoft cloud services.
- You have changed Microsoft 365 configurations or licences.
- Employees and contractors have changed roles.
- You have experienced phishing or account compromise.
- You are preparing for a compliance or customer security review.
- You have never formally reviewed your Microsoft 365 security.
The latest ASD guidance also stresses best-practice logging, replacing legacy technology and managing third-party risk as important areas for Australian organisations.
The Bottom Line: Secure Microsoft 365 Starts With Knowing Where You Stand
A Microsoft 365 security assessment is not about making your technology look complicated. It is about answering practical questions: Who can access your data? Which accounts have too much access? Can external users share information? Are your email controls working? Are important security events being logged and reviewed?
For Australian businesses, those answers are worth knowing before an incident forces you to find them out.
Borderless CS provides Microsoft 365 security assessment and implementation services covering identity, email, collaboration, data protection and security configuration.
Ready to review your Microsoft 365 security?
If you are unsure whether your current configuration still matches your business, start with a structured security assessment. It can help you identify the highest-priority gaps and create a practical plan for fixing them.
Talk to Borderless CS about your Microsoft 365 security assessment.
Is Microsoft 365 secure by default?
Although Microsoft 365 has numerous security services, businesses must adopt a security configuration and policy management approach based on the risk profile and the users and data the business processes.
What does a Microsoft 365 security assessment include?
The assessment includes checking configurations for identity and access, multifactor authentication, Conditional Access, Teams, Exchange, SharePoint, OneDrive, Defender, logging, data protection and security configurations, amongst others.
How often should you conduct a Microsoft 365 security assessment?
After large, important changes to your environment, also do this as part of your routine cybersecurity practices.
Is Office 365 security different from Microsoft 365 security?
Office 365 mainly refers to productivity and collaboration services, while Microsoft 365 is a broader package that can include identity, security, device management and compliance capabilities.
Why is Microsoft 365 security important for Australian SMEs?
Australian SMEs face phishing, email compromise, identity and other cyber risks. An assessment can help identify security gaps before they become costly business problems.