Microsoft 365 has become the backbone of modern business operations across New Zealand. Email, file storage, collaboration, and communication all sit within the platform. For many organisations, it’s indispensable.
But there’s a critical distinction that often gets overlooked.
Microsoft 365 is designed for productivity first — not security by default.
While the platform includes powerful security capabilities, they’re not fully enabled out of the box. And in our experience, many businesses assume they’re protected simply because they’re “on Microsoft.”
That assumption can be risky.
The Gap Between Capability and Configuration
Microsoft provides an extensive suite of security tools – multi-factor authentication, advanced email filtering, access controls, and monitoring capabilities.
However, these features require deliberate configuration, ongoing management, and regular review. Without that, businesses are left exposed in ways they may not realise.
Here are some of the most common gaps we see:
1. No Multi-Factor Authentication (MFA)
Passwords alone are no longer sufficient protection.
If an employee’s password is leaked, guessed, or reused from another compromised site, an attacker can gain immediate access to email, files, and internal systems.
MFA adds a critical second layer of defence. Without it, one compromised credential can quickly become a full-scale breach.
2. Limited or No Email Filtering
Phishing remains one of the most effective attack methods — and it’s constantly evolving.
Without properly configured email filtering:
- Malicious links land directly in inboxes
- Fake invoices look legitimate
- Impersonation attempts are harder to detect.
All it takes is one click.
3. Overly Broad Access Permissions
In many organisations, staff have access to far more information than they need to perform their roles.
This creates unnecessary risk:
- Sensitive data can be accessed, shared, or exposed unintentionally
- If an account is compromised, attackers inherit those same permissions.
Good security limits access to what’s necessary – nothing more.
4. No Visibility or Monitoring
Perhaps the most overlooked issue is the lack of visibility.
Without monitoring in place:
- Suspicious logins go unnoticed
- Unusual behaviour isn’t flagged
- Early warning signs of an attack are missed.
In many cases, businesses only discover an issue after damage has already been done.
Security Isn’t Automatic
It’s important to understand that simply subscribing to Microsoft 365 does not mean your environment is secure.
The platform gives you the tools – but:
- They need to be configured correctly
- They need to be monitored continuously
- They need to evolve as threats change.
This is where many organisations fall short.
A More Intentional Approach
The good news is that closing these gaps doesn’t require a complete overhaul of how your business operates.
A structured approach to Microsoft 365 security focuses on:
- Enforcing MFA across all users
- Implementing advanced email protection
- Applying least-privilege access controls
- Setting up monitoring and alerting
- Regularly reviewing and adjusting configurations.
These measures work quietly in the background, supporting your team without disrupting productivity.
A Conversation Worth Having
For most NZ businesses, Microsoft 365 is already a significant investment. The question is whether it’s delivering the level of protection your business actually needs.
Security isn’t something that happens automatically – it’s something that’s designed, configured, and maintained.
Taking the time to review and strengthen your setup today can prevent costly incidents tomorrow. Because when it comes to cybersecurity, it’s not just about having the right tools – it’s about using them properly.