You can have a perfectly configured Microsoft 365 tenant on Monday. By Friday, it’s already different.
No breach. No headline incident. No obvious failure.
Just drift.
A permission granted to “get something moving.”
An app connected during a pilot that never got reviewed.
A junior admin solving a problem quickly and moving on.
A Microsoft update that changes a default behind the scenes.
Nothing dramatic. Just gradual erosion.
And in 2026, that is one of the biggest risks facing CISOs and IT Directors managing Microsoft 365 estates.
There was a time when you could treat Microsoft 365 security as a programme of work. Run a hardening project. Review conditional access. Tighten policies. Pass the audit. Move on.
That model no longer works.
Microsoft ships updates constantly. New features appear. Old ones are deprecated. Authentication models evolve. Threat actors adapt faster than procurement cycles. By the time your annual audit report is written, parts of it are already out of date.
Security in 2026 isn’t a project you complete.
Instead it needs to be monitored and managed continuously, and that includes what happens in M365..
Let’s talk about access controls. Most tenants have more privilege than they think they do.
High-risk app permissions. Legacy service accounts. API connections granted “temporarily.” Admin roles that were meant to be short-term but never reviewed. Research suggests that over half of Microsoft 365 tenants have high-risk application permissions they’re not fully aware of. That’s not because teams are careless. It’s because environments grow.
Projects happen. Vendors integrate. Automations are introduced. Someone needs elevated rights “just to test something.” And then everyone gets busy.
The problem isn’t intent. It’s entropy.
Without deliberate review cycles, privilege accumulates. And accumulated privilege is what attackers look for first.
Annual or bi-annual audits create a false sense of stability. You freeze the environment. You assess it. You report on it. But the moment that snapshot is taken, the environment continues moving.
New users join. Roles change. Applications connect. Conditional access policies evolve. Teams and SharePoint sites multiply.
Security posture is not static. It is dynamic by default.
Continuous monitoring doesn’t replace governance. It enables it. It tells you when configuration drifts, when permissions expand, when policies no longer reflect reality.
Without that visibility, you are managing yesterday’s risk profile.
The baseline has shifted.
Basic authentication should already be gone. SMS-based MFA, while better than nothing, is increasingly insufficient for sensitive estates. Phishing-resistant methods - such as FIDO2 keys or certificate-based authentication - are no longer “advanced security.” They’re the minimum requirement.
But many organisations are operating in a hybrid state. Some users on strong authentication. Some on legacy methods. Some bypass policies in edge cases that were never fully secured.
Again, nothing looks broken. But the attack surface is uneven.
Security maturity in 2026 means consistency across the whole estate. Not just strong controls for senior leadership, but strong controls for everyone.
Attackers do not respect org charts.
Microsoft does a lot, and they do it well. The underlying infrastructure is resilient. Global threat intelligence is strong. Baseline protections are constantly improving.
But the shared responsibility model is exactly that. Shared.
In large-scale deployments, gaps appear because configuration choices, exceptions, and legacy decisions accumulate over time.
No single change is catastrophic. But the combination of small deviations creates exposure.
The challenge for CISOs and IT Directors isn’t understanding what “good” looks like. It’s maintaining it.
Security posture must be continuously aligned with:
That alignment cannot be validated once a year.
It has to be observed, adjusted, and reinforced as part of day-to-day operations. It has to be part of the rhythm of how your modern workplace runs.
If you reviewed your Microsoft 365 configuration six months ago, would it pass the same scrutiny today?
If you’d like an objective view of how your Microsoft 365 configuration is holding up against today’s realities, we’re always happy to have a conversation. No pitch - just a practical discussion about where drift typically appears and what “good” looks like in 2026.
Oliver Smith
Oliver Smith is TIEVA’s Microsoft Modern Work Go-To-Market Lead. Drawing on his previous experience as a Customer Success Manager at Ingram Micro, Oliver helps clients understand how Microsoft’s modern workplace technologies can support their goals, improve collaboration and deliver lasting business value.
oliver.keeling-smith@tieva.co.uk
