CLOUD & MICROSOFT 365 | NEXTPOINT TECHNOLOGY
Having Microsoft 365 or Azure doesn’t mean your cloud environment is being managed. It means it’s being used. There’s a significant difference — and most businesses don’t find out until something goes wrong.
By Matt Hermsen, Founder — NextPoint Technology | 6 min read
"We’re already in the cloud.”
It’s one of the most common things we hear from business owners when the topic of IT management comes up. They’re using Microsoft 365. Maybe they have SharePoint or Teams. Some have workloads running in Azure. A few have moved completely off on-premise servers.
And they’re right — they are using the cloud. But using the cloud and having a managed cloud environment are two completely different things. The distinction matters because the gap between them is where most small business security incidents, data losses, and compliance failures actually live.
This post explains what “using the cloud” actually means versus what it means to have it properly managed — and what’s silently at risk when nobody is minding the gap.
When most businesses say they’re in the cloud, what they mean is:
They pay for a Microsoft 365 subscription and employees use Outlook, Teams, and maybe OneDrive
Files live on SharePoint or in OneDrive instead of a local server
They might have Azure virtual machines running instead of physical servers
Software like their CRM, accounting platform, or ERP runs as a SaaS application
This is cloud adoption. It’s a legitimate step forward from running everything on-premise. But adoption is not administration. Buying a Microsoft 365 license is like buying a car — you still need to maintain it, insure it, and follow the rules of the road. Microsoft doesn’t do that for you.
The key misconception: Microsoft is responsible for the infrastructure running Microsoft 365. You are responsible for everything inside it — your users, your data, your security settings, your access controls.
Every major cloud provider — Microsoft, Amazon, Google — operates under what’s called a shared responsibility model. It’s exactly what it sounds like: some things are their responsibility, and some things are yours.
Microsoft’s side of the deal:
Physical data center security
Network infrastructure uptime
Core platform availability
Infrastructure-level compliance certifications
Your side of the deal:
Who has access to what — and whether that access is appropriate
Whether multi-factor authentication is enforced on every account
How data is classified, retained, and protected
Whether your security settings are configured correctly or still sitting on defaults
Backing up your Microsoft 365 data — yes, this is your responsibility, not Microsoft’s
Monitoring for suspicious sign-ins, unusual activity, and policy violations
Managing devices that access your cloud environment
⚠️ Microsoft does not back up your Microsoft 365 data by default. If an employee accidentally deletes a SharePoint site, a mailbox gets corrupted, or ransomware encrypts your OneDrive files, Microsoft’s standard retention policies have limits. Your data is your responsibility.
Most businesses that “use the cloud” without actively managing it are operating with a version of their environment that looks fine on the surface. Underneath, it’s a different story.
Microsoft 365 ships with default configurations that are designed for broad compatibility, not maximum security. Out of the box, many tenants have:
Legacy authentication protocols enabled — these bypass MFA entirely and are a primary attack vector
No conditional access policies — meaning any device, anywhere in the world, can attempt to sign in
Weak external sharing settings on SharePoint and OneDrive
No audit logging configured — so when something happens, there’s no trail to follow
Guest access open by default in Teams
Most businesses have never touched these settings. They subscribed, set up email, and started using it. The defaults are still in place.
In an unmanaged Microsoft 365 environment, access tends to accumulate over time. Former employees whose accounts were never fully deprovisioned. Contractors who were given access to a SharePoint site for a project and never removed. Admin rights granted temporarily and never revoked.
Every one of those is an open door. And because nobody is actively reviewing it, nobody knows the doors are open.
This one surprises almost every business owner we talk to. Microsoft’s standard Microsoft 365 subscription does not include comprehensive backup of your data. Email, SharePoint, OneDrive, and Teams data is subject to Microsoft’s own retention policies — which have windows and limitations that are not the same as having a real backup.
Ransomware that syncs through OneDrive can encrypt your cloud files just as effectively as local ones. Accidental deletion beyond the recycle bin retention period is permanent. Without a third-party backup solution covering your Microsoft 365 environment, your cloud data is more exposed than most business owners realize.
On a lighter note — but still worth raising — unmanaged Microsoft 365 tenants almost universally have license waste. Former employees still consuming paid licenses. Users assigned premium tiers they don’t need or features they’ve never used. Organizations paying for Microsoft 365 Business Premium and using it like Microsoft 365 Basic.
A proper license audit and management process typically finds meaningful savings in any organization that hasn’t actively managed this.
Area | Just Using the Cloud | Actively Managed |
Security config | Default settings, mostly untouched | Hardened to current best practices |
MFA | Enabled for some, maybe not all | Enforced for every user, every login |
Access control | Accumulates over time | Reviewed and right-sized regularly |
Former employees | Often partially deprovisioned | Fully offboarded within hours |
Backup | Relying on Microsoft retention limits | Third-party backup covering all workloads |
Monitoring | No one watching | Sign-in logs and alerts reviewed regularly |
Conditional access | Not configured | Policies enforced by user, device, location |
License management | Set and forgotten | Audited and optimized |
Compliance posture | Unknown | Documented and maintained |
Actively managing a Microsoft 365 environment means someone is doing the following on an ongoing basis — not just when something breaks:
Enforcing MFA across every user account with no exceptions
Configuring and maintaining conditional access policies based on user role, device compliance, and location
Disabling legacy authentication protocols that bypass modern security controls
Running regular access reviews — who has what permissions and whether they still need them
Fully deprovisioning departing employees within a defined window — account disabled, licenses reclaimed, data preserved per policy
Monitoring sign-in logs for unusual activity — impossible travel, unfamiliar locations, repeated failures
Running a third-party backup solution that covers Exchange Online, SharePoint, OneDrive, and Teams
Reviewing external sharing settings and guest access regularly
Keeping audit logging enabled and retained for the appropriate period
Managing Microsoft 365 licenses actively — right user, right tier, no waste
Staying current on Microsoft’s security recommendations and Secure Score
None of this is one-and-done. Microsoft’s platform changes. Your organization changes. Threats change. Managing a cloud environment is an ongoing discipline, not a setup task.
Everything above applies to Microsoft 365. For businesses running workloads in Azure, the stakes are higher and the complexity is greater.
Azure gives you enormous control over infrastructure — virtual machines, networking, storage, databases, identity. That control comes with responsibility. An unmanaged Azure environment commonly has:
Virtual machines running outdated OS versions with unpatched vulnerabilities
Overly permissive network security groups that expose services to the internet unnecessarily
No monitoring or alerting configured through Microsoft Defender for Cloud
Storage accounts with public access enabled
Service principals and managed identities with excessive permissions
No cost controls or budget alerts — leading to bill surprises
Azure is a powerful platform. Unmanaged, it’s also an expensive and potentially vulnerable one. The businesses that get the most out of Azure are the ones with someone actively governing it.
Using the cloud is a good thing. It’s more flexible, more scalable, and in many cases more secure than running everything on-premise — but only when it’s managed properly.
The Microsoft 365 tenant sitting on default settings with legacy authentication enabled and no backup in place is not more secure than an on-premise server. It’s just a different set of risks — ones that are less visible because they live behind a login screen instead of in a server room.
"We use the cloud" is a starting point, not a finish line. The question isn’t whether you’re in the cloud — it’s whether anyone is actually managing what’s in it.
If you’re not sure where your Microsoft 365 or Azure environment stands, start here:
Is MFA enforced for every user with no exceptions?
When did you last review who has admin rights in your Microsoft 365 tenant?
Do you have a third-party backup covering your Microsoft 365 data?
Is legacy authentication disabled in your tenant?
When a staff member left recently, was their account fully deprovisioned — or just had the password changed?
Do you have conditional access policies in place?
When did you last look at your Microsoft Secure Score?
If the honest answer to most of those is “I’m not sure,” your cloud environment is being used — not managed. That’s a fixable problem, but it’s worth fixing before it becomes an unfixable one.
Not Sure How Your Microsoft 365 Environment Is Actually Configured?
NextPoint Technology offers a free 30-minute IT assessment that includes a review of your Microsoft 365 security posture — MFA status, legacy authentication, access controls, backup coverage, and more. We’ll tell you exactly where things stand, no pressure.
Dubuque, Iowa and nationwide.
NextPoint Technology · Dubuque, Iowa · www.nextpointtechnology.com
Let's talk about how NextPoint Technology can help simplify IT for your business.