Cloud platforms make it easy to store and share data. They also make it easy to accidentally make that data publicly accessible. Cloud misconfiguration — not external attacks — is responsible for a significant proportion of data exposures. Here's what to check in your Microsoft 365 and cloud environment.
In 2019, Capital One — one of the largest US banks — suffered a breach that exposed the personal information of over 100 million customers. The cause wasn't a sophisticated hack: a misconfigured AWS S3 bucket allowed a former AWS employee to access data that should have been private. This type of incident has a long list of repeat offenders: Facebook, Microsoft, Toyota, and hundreds of smaller companies have all had data exposures caused by cloud misconfiguration rather than external attack.
For NZ businesses using Microsoft 365 and Azure, the equivalent risks exist across SharePoint Online, OneDrive, Power Apps, and Azure Storage — and are less commonly checked than they should be.
SharePoint and OneDrive Sharing Settings
Microsoft 365's default sharing settings in some tenant configurations allow staff to share SharePoint files and OneDrive documents with "Anyone with the link" — meaning anyone who obtains the link can access the file without authentication. A link shared in a Teams message, forwarded in an email, or accidentally posted publicly provides unauthenticated access to the document.
Optimyze reviews and restricts sharing settings as part of Microsoft 365 tenant hardening: limiting external sharing to authenticated external users only (removing "Anyone with the link" permissions), restricting sharing domains to approved partner organisations where applicable, and enabling sharing expiration so shared links don't remain active indefinitely.
Power Apps and Power Automate
Microsoft Power Apps allows staff to create simple business applications without IT involvement. This is a legitimate productivity tool — but Power Apps that connect to business data sources (SharePoint lists, Excel files, SQL databases) and are shared with external users without appropriate access controls can expose business data to anyone who receives the app link. Organisations should maintain a registry of Power Apps in use and review their data connections and sharing settings regularly.
Microsoft Teams External Access
Microsoft Teams allows external guests to be added to Teams channels, giving them access to the channel's files, history, and shared documents. Guest users who leave an organisation should be removed from all Teams they were added to — but this is frequently overlooked in offboarding processes. Regular review of external guest access (available in the Microsoft Entra admin portal under Guest Users) identifies stale guest accounts that should be removed.
The Microsoft Secure Score
Microsoft 365 includes a Secure Score — a measurable assessment of tenant security configuration relative to Microsoft's recommended baseline. Optimyze reviews and improves Secure Score as part of every Microsoft 365 managed engagement. The score directly reflects misconfiguration risk — a Secure Score below 50% indicates significant misconfiguration exposure in the tenant's settings.
Cloud misconfigurations are often not errors — they're features used incorrectly. Files shared too broadly, guest access not revoked, and platform capabilities used without security review create data exposure that looks like an external breach but originates from inside the business.
