6 ways to prevent misconfiguration and avoid cloud breaches

About 165 organizations had data stolen from their Snowflake cloud accounts in 2024, and Snowflake itself was never hacked. Mandiant traced every incident it investigated to customer accounts signed in with stolen passwords, many taken by infostealer malware years earlier and never changed, on accounts that didn’t require multi-factor authentication. That is what a cloud misconfiguration looks like in practice: a setting left open, with no clever exploit required.

The settings that matter most in Microsoft 365 and Azure are well documented, and Microsoft gives you free tools to check them.

Where a cloud misconfiguration starts

Microsoft’s shared responsibility guidance says that whatever cloud service you use, the customer always keeps responsibility for four things:

• Your data: how it is classified, protected and governed.
• Your endpoints: the laptops, desktops and phones that connect.
• Your accounts: creating, managing and removing users.
• Access management: roles, multi-factor authentication and Conditional Access.

A misconfiguration is any gap on that side: an admin account without MFA, a SharePoint folder shared with “anyone with the link,” an old employee account still active, or a storage resource open to the internet. The tenants we review most often run on Microsoft’s defaults everywhere, which means many of these choices were never made on purpose.

1. Find every cloud app your team uses

You can’t configure what you don’t know about. Staff sign up for file sharing sites, e-signature tools, scheduling apps and AI tools on their own, and each one holds company data with its own settings.

Start by asking department heads what they use, then check expense reports and single sign-on logs. Microsoft Defender for Cloud Apps, where your licensing includes it, can analyze traffic and compare it against a catalog of more than 31,000 cloud apps, scoring each one for risk. Decide which apps are approved, move the data out of the rest, and close those accounts.

2. Lock down sign-ins and admin accounts

Identity is where most cloud breaches start, so this is the highest-value fix.

• Require MFA for everyone. Microsoft now requires MFA to sign in to the Azure portal, Microsoft Entra admin center, Intune admin center and Microsoft 365 admin center, and since October 1, 2025, for create, update and delete actions through Azure command-line tools. That covers admins in those portals. Every other user still needs it.
• Keep Global Administrators to fewer than five, as Microsoft recommends, and give people the narrowest admin role that does the job.
• Use separate admin accounts. Nobody should read email or browse the web with an account that can change tenant settings.
• Block legacy sign-in methods, which can’t do MFA. Microsoft’s free security defaults block them, and Conditional Access gives finer control with Entra ID P1 or Microsoft 365 Business Premium.

For our clients, admin accounts use phishing-resistant sign-in such as security keys or passkeys, and everyone else approves sign-ins in an app with number matching. Our posts on access management and push bombing explain why.

3. Tighten sharing and data protection

SharePoint and OneDrive let you choose how widely files can be shared outside the company: with anyone holding a link, with verified guests, with existing guests only, or not at all. Many organizations never change the default.

• Restrict “Anyone” links, or at least make them expire and limit them to view-only.
• Set guest access to expire automatically after a set number of days.
• Use sensitivity labels so protection travels with confidential files.
• In Azure, keep storage accounts and databases off the open internet unless they truly need to be reachable.

For healthcare, accounting, legal and nonprofit offices, sharing settings are a compliance issue as well. A patient file or tax return shared by public link is a disclosure you may have to report. Our compliance services start with exactly these settings.

4. Measure your settings with free tools

• Microsoft Secure Score, in the Microsoft Defender portal, measures your Microsoft 365 identities, apps and devices against recommended actions and shows the steps to improve.
• ScubaGear, published by CISA, checks a Microsoft 365 tenant against CISA’s Secure Cloud Business Applications baselines for Entra ID, Exchange Online, SharePoint, Teams, Defender, Power BI and Power Platform. Have someone familiar with PowerShell and Microsoft 365 admin roles run it and read the results.

Treat the results as a to-do list. Some recommendations won’t fit your organization, and that is fine as long as the decision is deliberate and written down.

5. Get alerts when important settings change

A tenant set up correctly last year may not be correct today. Settings change when an admin makes a mistake, a third-party app is granted permissions, a feature update arrives, or an attacker gets in with a stolen login. Microsoft 365 alert policies can notify you when a user gets Exchange admin rights or a new mail forwarding rule appears, a classic sign of a compromised mailbox. Admins can add custom alerts too. Send them to someone who reads them every day.

6. Review on a schedule, with a second set of eyes

Put a cloud configuration review on the calendar at least once a year, and after any big change like a merger, a new office or a new line-of-business app. Check admin roles, guest accounts, sharing settings, app permissions and MFA coverage.

Office managers and executive directors shouldn’t have to know every Microsoft setting. Someone who works in these consoles daily will spot in an hour what might take you a week. Every new client of ours gets an onboarding compliance review that Chad Odom, our owner, signs. As a Microsoft CSP partner, we configure and monitor our clients’ Microsoft 365 and Azure tenants from there. For the wider picture, see our cloud security best practices.

Many of the tenants we review still run on Microsoft’s defaults. Book a 15-minute call and we will talk through where to look first in yours. More on our Microsoft 365 and cloud services pages.

Related reading: Are forgotten cloud resources quietly draining your budget?, Azure Local vs. VMware ESXi: Key differences you need to know and How to choose a cloud service provider for your business.

Frequently asked questions

What is a cloud misconfiguration?

A cloud misconfiguration is a gap on the customer’s side of a cloud service: an admin account without MFA, a SharePoint folder shared with anyone who has the link, a former employee’s account still active, or storage open to the internet. Most come from defaults nobody changed on purpose.

How do cloud misconfigurations lead to data breaches?

Attackers use the open setting directly, with no exploit needed. In the 2024 Snowflake attacks, about 165 organizations lost data because accounts were signed in to with stolen passwords and didn’t require MFA.