Topic starter
27/06/2026 1:40 pm
TL;DR: Default Microsoft 365 settings still let standard users register devices, enroll MFA, and abuse OAuth device code flow, while CIS v6 adds 29 new controls across Entra, Intune, Teams, Defender, and Exchange, according to Abnormal AI. The deeper issue is that tenants treat platform defaults as acceptable until an attacker proves otherwise, which turns unreviewed identity settings into a governance failure.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “29 New Controls, No Action Required: Abnormal SPM Now Evaluates Microsoft 365 Against CIS v6”.
Key questions
Q: What breaks when Microsoft 365 permissions and settings are left unmanaged?
A: Attackers inherit a much larger blast radius.
Q: Why does OAuth device code flow increase account takeover risk?
A: It lets an attacker obtain a valid token through a legitimate Microsoft authentication path without stealing a password or necessarily triggering the victim's normal MFA experience.
Q: How should teams prioritise Microsoft 365 hardening work?
A: Start with controls that remove silent trust paths, especially device join, MFA registration, device code flow, and inbound mail allow-lists.
Practitioner guidance
- Benchmark the tenant against a current CIS baseline Compare Entra, Intune, Teams, Defender, and Exchange settings to a current CIS control set and record which defaults remain permissive.
- Block OAuth device code flow where it is not required Disable device code sign-in in tenants that do not have a documented business need for it, and review any exception through a named owner and expiry date.
- Restrict device join and MFA enrollment paths Limit device registration to approved users or groups, require managed-device status before MFA registration, and ensure Intune compliance is enforced before access is trusted.
Bottom line: Microsoft 365 defaults can leave meaningful identity and messaging trust paths open even when no one has intentionally created a policy gap.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:06 pm
Unreviewed defaults are the real Microsoft 365 governance gap. The article shows that the platform's out-of-the-box state can leave device registration, MFA enrollment, and email trust paths open until someone actively benchmarks them. That is not a tooling problem. It is a governance failure in which the control exists but the organisation has never asserted its intended baseline. Practitioners should treat default state as an unaudited security posture, not as a safe starting point.
A few things that frame the scale:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
A question worth separating out:
Q: How can organisations tell whether Microsoft 365 controls are actually working?
A: Look for declining numbers of stale guests, reduced broad-group memberships, faster removal of obsolete delegated access, and shorter exposure windows for sensitive repositories. If those measures do not improve over time, the programme may be producing reports without changing actual access conditions.
👉 Read our full editorial: Microsoft 365 default settings expose tenant security gaps