Microsoft 365 Security: The Hidden Gap Between Perception and Reality

Rating yourself highly does not lower your compromise rate.

CoreView found organizations that describe their Microsoft 365 security as "advanced" show account-compromise rates nearly identical to those with basic implementations. Self-assessment and actual protection have almost nothing to do with each other.

This is the survey's core finding, and it should stop every business owner cold. Sixty percent of respondents rate themselves "established" or "advanced." Sixty-eight percent got attacked. The two groups overlap heavily. Feeling secure and being secure are different states, and the report shows most companies cannot tell which one they are in.

In 35 years around IT, this is the pattern we see most with Houston companies: the tools got bought, the project got marked done, and nobody ever checked whether the settings held. Security is not a purchase. It is a state you have to keep verifying.

Six vulnerabilities that compound into real risk across Microsoft 365.

CoreView identified six weaknesses that turn a normal Microsoft 365 tenant into an attack surface: tenant sprawl, over-privileged apps, backup misconceptions, weak configuration control, failed least privilege, and undetected configuration tampering.

None of these is exotic. Each is the quiet result of a platform that grew faster than anyone documented. For a Houston CPA practice or engineering firm running lean, they stack up fast.

• Multi-tenant complexity. 78% of organizations run more than one tenant and 45% run more than five, which makes unified governance nearly impossible.
• Over-privileged applications. 51% have 250+ Entra applications with read-write permissions, each one as dangerous as a global admin account.
• Backup misconceptions. Nearly half wrongly assume Microsoft backs up their configuration, so they are defenseless when settings get wiped.
• Poor configuration management. 65% manage Microsoft 365 configuration without following best practices, inviting avoidable outages.
• Failed least privilege. 63% of tenants do not enforce least privilege, even though proper privileged-access management cuts incidents by 64%.
• Configuration tampering. Microsoft logged 176,000 tampering instances in May 2024 alone, a 79% jump since 2023, yet 48% of organizations report seeing little of it.

The tampering number is the one to sit with. If Microsoft is recording 176,000 tampering events in a single month and half of companies say it is not happening to them, the honest read is that they cannot see it. You do not get to report on what you never detect.

Turning MFA on is not the same as enforcing it.

CoreView found 90% of organizations have some form of MFA, but only 41% have automated detection and enforcement. That leaves 59% with no real assurance the control they bought is doing anything.

Here is the part that should change how you think about it. Microsoft's own data shows 99.9% of account compromises hit accounts without MFA. So you would expect the 90% who deployed MFA to be nearly bulletproof. They are not. The report found environments that have MFA but no enforcement get compromised at rates close to environments with no MFA at all.

Read that twice. MFA you set up once and never enforced protects you about as well as MFA you never set up. The organizations that automated detection and enforcement saw 53% fewer account-compromise incidents. Enforcement is the whole difference.

We see this twice a month with Houston businesses. MFA shows as "on" in the admin center, but there is a legacy protocol left open, a break-glass account with no second factor, or a conditional-access policy in report-only mode that never got switched to enforce. The control exists. Nobody is watching whether it holds.

The service chart matters here because the more of the Microsoft stack you run, the more places enforcement can quietly fail. CoreView also found mid-market companies sit further behind: 72% of enterprises have privileged-access management versus just 43% of mid-market. Smaller Houston firms carry the same threat exposure with fewer of the controls that stop it.