The Remote Worker's Guide to Safely Navigating Microsoft 365
- by Brittany Day

Microsoft 365 Users Face Heightened Risk without Effective Supplementary Protection
The static, single-layered built-in email security features in Microsoft 365 alone are unable to anticipate zero-day exploits, and have proven insufficient in safegaurding users against credential phishing, account takeovers and other sophisticated modern threats. According to Osterman Research, despite existing protection, 40% of Microsoft 365 users have experienced credential theft nevertheless.
The FBI has issued multiple warnings regarding sophisticated COVID-19 related business email compromise (BEC) scams targeting cloud email users, and strongly urges businesses to implement critical additional layers of email protection in Microsoft 365. Consistent with the FBI’s findings, Guardian Digital has identified and blocked more malicious emails targeting Microsoft 365 users in 2020 than in any other year in the company's twenty-two year history.
Fortifying Microsoft 365 email requires a layered supplementary email security solution designed to close the dangerous gaps in default cloud email protection, along with vigilant, secure behavior online and the implementation of the security best practices outlined in this article.
What Are My Risks Using Microsoft 365?
In order to safely navigate Microsoft 365, it is critical that remote workers fully understand the threats they face on a daily basis, including:
- Phishing: Cyber criminals are taking advantage of remote employees’ increased dependence on cloud email, and are launching sophisticated phishing campaigns targeting Microsoft 365 users, many of which continue to exploit the pandemic. These scams employ highly deceptive tactics such as impersonating government agencies, advertising fraudulent vaccines and asking for donations. According to the US Department of Homeland Security, there has been “an increase in phishing attacks under the guise of coronavirus-themed emails containing attachments” - a trend that persists to this day.
- Malware: Threat actors are targeting Microsoft 365 users with malware designed to infect and destroy their computers by wiping files or rewriting a computer's master boot record (MBR). This malware can be geared toward either destruction or financial gain.
- Insecure networks: Incidents involving insecure configurations of services and firewalls have increased, as administrators are taking shortcuts to enable remote access for employees. From dealing with insufficient bandwidth, undersized VPN infrastructure and limited availability of managed devices for employees to take home, many businesses are unprepared to accomodate a remote workforce - and network security has suffered.
- Microsoft 365 vulnerabilities: Microsoft Exchange Online Protection (EOP) - the default security defenses provided in Microsoft 365 - is glaringly inadequate, leaving remote employees vulnerable to credential phishing, account takeovers and other advanced threats. According to the FBI, 30% percent of phishing attacks make it through existing systems and are opened by target cloud email users.
Tips & Advice for Staying Safe in Microsoft 365
We want to help you safely navigate Microsoft 365 regardless of your current work environment. Here are a few tips and best practices to help keep you and your business secure:
- Implement a comprehensive, fully-managed email security solution that seamlessly complements Microsoft Exchange Online Protection (EOP), providing the critical additional layers of security that Microsoft 365 lacks.
- Choose a strong password and enable multi-factor authentication (MFA).
- Ensure that Azure AD password sync is configured correctly.
- Enable mailbox auditing and unified audit logging in the Security and Compliance Center.
- Disable legacy email protocols (if not required).
The Bottom Line
We recognize that properly setting up and securely navigating Microsoft 365 while working remotely may seem challenging and overwhelming. The harsh reality is that organizations cannot rely on administrators to configure their cloud email service to be 100 percent secure. Thus, implementing a fully-managed solution that seamlessly complements Microsoft 365 default protection, bolstering EOP's features with critical additional layers of defenses, is the most effective way to fortify cloud email against sophistiacted modern threats. Ongoing expert system monitoring, maintenance and support can simplify administration, improve security and reduce costs - delivering a rapid return on investment (ROI).
Want to learn more about how to prevent attacks in Microsoft 365? If so, be sure to check out our free Microsoft 365 protection guide. For more email security tips and advice on how to stay safe online, we encourage subscribe to our weekly Behind the Shield newsletter.
Have additional questions on how to safely navigate Microsoft 365? Please do not hesitate to reach out to us - we are eager to help!
Must Read Blog Posts
- Demystifying Phishing Attacks: How to Protect Yourself in 2023
- What You Need to Know to Shield Your Business from Ransomware
- Shortcomings of Endpoint Security in Securing Business Email
- Microsoft 365 Email Security Limitations You Should Know in 2023
- Email Virus - Complete Guide to Email Viruses & Best Practices
- How Phishing Emails Bypass Microsoft 365 Default Security
Latest Blog Articles
- How To Spot A DocuSign Scam Email
- What To Do If Your Business Email Gets Hacked
- Why Do Over 90% of Cyberattacks Begin with an Email?
- FBI: The 2020 Presidential Election Is Under Attack by Email Scammers
- Why Is Machine Learning (ML) Beneficial in Security?
- What Is a Cyberattack?
- Cyber Risk Is On the Rise: How To Ensure Preparedness
- How to Protect Sensitive Data & Maintain Client Trust in Financial Services Industry
- Revolutionizing Email Security: The Evolution of EnGarde Secure Linux to EnGarde Cloud Email Security
- Open Source Utilization in Email Security Demystified