When investors and their consultants conduct Operational Due Diligence (ODD) on prospective investment funds, the cybersecurity questionnaire is often rigorous. DDQs cover penetration testing, BCP/DR, third-party risk, security awareness training and incident response plans. Yet, despite this thoroughness, one of the most critical environments is frequently overlooked: Microsoft 365 (M365).
For most modern investment funds, Microsoft 365 is the operational nerve center. It is where the “crown jewels” reside. Deal pipelines, proprietary financial models, wire transfer instructions, Personally Identifiable Information (PII), and sensitive communications are all stored in Exchange, SharePoint, and OneDrive. Assuming that “cloud equals secure” or that Microsoft handles everything out of the box is a dangerous misconception. The reality is a shared responsibility model, and poor tenant configuration by the fund can leave investors exposed to devastating breaches.
The Overlooked Reality
Many DDQs ask broad questions like, “Do you have Multi-Factor Authentication (MFA) enabled?” When a fund checks “Yes,” the consultant moves on. However, binary questions fail to uncover critical misconfigurations within the M365 environment that can render those defenses completely useless.
3 Real-World M365 Security Risks
To truly evaluate a fund’s security posture, DDQ consultants must dig deeper into how the fund’s M365 tenant is architected. Here are three critical examples of Microsoft 365 risks that often go unnoticed in current standard assessments because M365 is not in scope of DDQ questionnaires:
1. Legacy Authentication Bypassing MFA
A fund might mandate MFA for all user logins, allowing them to answer “Yes” on the DDQ. However, if they have not explicitly disabled Legacy Authentication (older protocols like IMAP, POP3, or legacy Office clients), they have left the back door wide open. Legacy protocols do not support MFA. An attacker who acquires a user’s password (via a phishing campaign or a dark web credential dump) can simply use a legacy protocol to log in, completely bypassing the MFA requirement and gaining full access to the victim’s inbox to intercept wire transfers or steal data.
2. Lack of Conditional Access Policies
Relying solely on a username and password—even when backed by basic MFA—is no longer sufficient for institutional-grade security. Funds often fail to implement Microsoft Entra ID (formerly Azure AD) Conditional Access policies. Without these policies, a threat actor can attempt to log into a fund manager’s account from a high-risk country or an unmanaged, malware-infected personal device. Proper M365 security requires context-aware controls, such as restricting access exclusively to compliant, company-issued devices or outright blocking logins from geographical regions where the fund does not conduct business. Microsoft issued a statement disabling SMS and Phone MFA and recommend using passkeys now. We had never understood why this was enabled in the first place and let our clients disable these MFA methods a long time ago.
3. Insecure External Sharing and Data Sprawl
SharePoint and OneDrive make collaboration incredibly easy—sometimes too easy. Without strict governance, employees can generate anonymous sharing links to sensitive folders containing personal data, cap tables, or DDQ responses that never expire. Furthermore, if external guest accounts are not regularly reviewed and pruned, former partners, consultants, or vendors may retain access to proprietary fund data indefinitely. A robust M365 environment enforces expiration dates on sharing links, blocks anonymous sharing, and utilizes Data Loss Prevention (DLP) rules to stop sensitive information from leaving the tenant. In addition, Microsoft Teams, by default, enables data sharing with external providers like Dropbox and Google without investment funds knowing about this.
Recent Microsoft 365 Incidents
| In July 2023, Microsoft disclosed that a China-linked threat actor (Storm-0558) obtained a highly sensitive Microsoft Account (MSA) cryptographic signing key. The attackers used this key to forge authentication tokens, bypassing normal access controls to steal approximately 60,000 emails from the U.S. State Department and other government agencies. The Cyber Safety Review Board (CSRB) later issued a scathing report on the preventable nature of this breach. In January 2024, Russian state-sponsored hackers (APT29 / Midnight Blizzard) successfully breached Microsoft’s own corporate systems. They accomplished this by conducting a password spray attack against a legacy, non-production test tenant account that did not have Multi-Factor Authentication (MFA) enabled. They abused OAuth application privileges to escalate their access and steal emails from Microsoft senior leadership and cybersecurity teams. In May 2026, Microsoft Threat Intelligence published a post-mortem on Storm-2949. Instead of using zero-day software exploits or malware, the group used social engineering and abused native Entra ID Self-Service Password Reset (SSPR) features to bypass MFA prompts. After taking over high-privileged IT identities, the attackers used native Microsoft Graph APIs and Azure management tools to map the directory, steal VPN configurations from SharePoint/OneDrive, and successfully pivot into Azure App Services, SQL databases, and Key Vaults to exfiltrate production secrets. |
Upgrading the DDQ
It is time for investors and ODD consultants to upgrade their questionnaires. Stop asking simply if a fund uses Microsoft 365 or MFA, and start asking how they secure it. Request evidence of their Microsoft Secure Score, inquire about their Conditional Access policies, and explicitly verify that legacy authentication is blocked globally across the tenant.
By shining a light on this critical blind spot, you protect not just the fund’s assets, but the sensitive data and capital of every investment fund involved.
