Cloud Security for Microsoft 365, Azure, AWS and Google Workspace

The shared responsibility model, in plain terms

Microsoft, Amazon and Google secure the buildings, hardware, hypervisors and core platform. You are responsible for everything you configure on top: who has accounts, what those accounts can reach, what is shared externally, whether MFA is enforced, and whether your data is backed up somewhere the platform cannot lose it.

That division is where most incidents happen. The provider almost never fails. The customer configuration frequently does — a storage bucket set to public, a guest account from a finished project still holding access, a global administrator with no MFA because it is "a service account".

Microsoft 365: where SME risk concentrates

For most UK small businesses, the Microsoft 365 tenant is now the crown jewels — it holds the email, the documents, the customer data and the identities that unlock everything else. It is also where business email compromise happens, and that is the single most common serious incident we deal with.

The fixes are well understood and mostly free with licences you already hold: enforce MFA for every user including administrators, block legacy authentication protocols that bypass MFA entirely, restrict who can create mailbox forwarding rules to external addresses, limit anonymous sharing links, and turn on the audit logging that makes an investigation possible.

• ✓MFA enforced on all accounts, including break-glass administrators
• ✓Legacy authentication protocols blocked outright
• ✓Conditional access policies for location, device and risk
• ✓External auto-forwarding restricted and alerted on
• ✓Anonymous and organisation-wide sharing links reviewed and constrained
• ✓Unified audit logging enabled with adequate retention
• ✓Third-party backup, since native retention will not survive a malicious deletion

Azure, AWS and Google Cloud reviews

Where clients run infrastructure rather than just office software, we review against the CIS Foundations Benchmark for the relevant platform. The recurring findings are consistent across every platform: over-permissive identity and access management roles, storage exposed more broadly than intended, security groups open to the whole internet, absent or unretained audit logging, and unencrypted data at rest.

Where infrastructure is defined in Terraform or CloudFormation we review the code as well as the deployed state, because fixing the console without fixing the template means the misconfiguration returns at the next deployment.

• ✓IAM roles and policies reviewed for least privilege and unused permissions
• ✓Storage buckets and volumes checked for public exposure and encryption
• ✓Network security groups and firewall rules reviewed for over-broad access
• ✓Audit logging, retention and alerting verified as investigable
• ✓Infrastructure-as-code templates reviewed alongside deployed state
• ✓Kubernetes RBAC and pod security where containers are in use

Cloud data is not backed up by default

This surprises people, so it is worth stating directly: Microsoft 365 retention policies and recycle bins are not a backup. They protect against accidental deletion for a limited window. They do not protect against a malicious administrator, a compromised account systematically purging mailboxes, or a ransomware event that syncs encrypted files up to SharePoint.

Microsoft says as much in its own service agreement, which places responsibility for data backup on the customer. A third-party backup for your cloud tenant is inexpensive and is one of the first things we recommend.