---
title: "Ransomware and Microsoft 365: the Complete Guide"
description: In a Microsoft 365 tenant, people and endpoints form the links attackers pull on.
image: https://www.sirkit.ca/hubfs/Ransomware%20and%20Microsoft%20365.png
---
[Skip to main content](https://www.sirkit.ca/blog/ransomware-and-microsoft-365#main-content)
[ ](https://www.sirkit.ca)
- Show submenu for Services Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [Show submenu for About Us About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- Show submenu for About Us About Us
- About Us
- [About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
- [Connect with our Team](https://www.sirkit.ca/contact)
[Connect with our Team](https://www.sirkit.ca/contact)
[Skip to main content](https://www.sirkit.ca/blog/ransomware-and-microsoft-365#main-content)
This is an announcement bar or top menu bar. Additional content can go here.
[ ](https://www.sirkit.ca)
- Show submenu for Services Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [Show submenu for About Us About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Managed IT](https://www.sirkit.ca/managed-it-services)
- [Co-Managed IT](https://www.sirkit.ca/co-managed-it-services)
- [Integrated IT Solutions](https://www.sirkit.ca/integrated-it-solutions)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- Show submenu for About Us About Us
- About Us
- [About Us](https://www.sirkit.ca/about)
- [Executive Team](https://www.sirkit.ca/about?#exec)
- [Careers](https://www.sirkit.ca/careers)
- [Contact Us](https://www.sirkit.ca/contact)
- [Blog](https://www.sirkit.ca/blog)
- [Get Started](https://www.sirkit.ca/contact)
[Get Started](https://www.sirkit.ca/contact)
Categories
- [Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
- [Technical Pro-tips and How-to](https://www.sirkit.ca/blog/tag/technical-pro-tips-and-how-to)
- [Knowledge Base (KB)](https://www.sirkit.ca/blog/tag/knowledge-base-kb)
- [SIRKit News](https://www.sirkit.ca/blog/tag/sirkit-news)
- [Product Reviews](https://www.sirkit.ca/blog/tag/product-reviews)
- [SIRKit360® News](https://www.sirkit.ca/blog/tag/sirkit360-news)
# Ransomware and Microsoft 365: the Complete Guide
[Kris Wilkinson](https://www.sirkit.ca/blog/author/kris-wilkinson)
Sep 19, 2025
Microsoft 365 is one of the most secure business platforms in the world. But here’s the catch: Microsoft protects the infrastructure but you’re responsible for how people sign in, how data is shared, and how licenses are set up.
That’s where most problems happen. If those [Office security](https://www.sirkit.ca/blog/six-most-overlooked-devices-to-protect-in-your-office) basics aren’t tight, ransomware, accidental deletion and data loss can still bring your business to a halt.
This post breaks down:
- What Microsoft already covers by default
- The gaps that show up in real businesses
- Simple steps every owner or ops leader should take to close them
## What Microsoft Protects by Default
Out of the box, Microsoft 365 gives you:
- Secure cloud infrastructure + encryption in transit and at rest
- File version history + recycle bins in OneDrive/SharePoint
- Baseline [spam and malware filtering](https://www.sirkit.ca/blog/microsoft-365-spam-protection-and-how-to-review-quarantined-items) (EOP)
- [Extra protections with Defender](https://www.sirkit.ca/blog/why-your-business-needs-microsoft-defender-for-office-365) for [Office 365](https://www.sirkit.ca/blog/the-smb-guide-to-office-365) (Safe Links, Safe Attachments, impersonation rules) when licensed and turned on
These are strong safety nets. But gaps usually come from how accounts are configured and how people use the tools.
## Where Gaps Appear (and How to Fix Them)
1. Weak sign-ins and phishing
Most Microsoft 365 compromises begin with phishing or stolen credentials. The risk isn’t just a forgotten password, it’s outdated settings that leave doors open:
- Inconsistent MFA or relying on SMS codes
- Old protocols (POP/IMAP) that bypass modern protections
- Auto-forwarding rules that quietly move data externally
- No alerts on risky sign-ins or suspicious app permissions
2. Too much admin access
Too many Global Admins (or permanent admin rights) magnify damage if one account is compromised. Microsoft recommends no more than 2–4 Global Admins.
Fixes that work:
- Use Privileged Identity Management (PIM) so admin rights are temporary and approved
- Apply Conditional Access for all admin roles
- Review and trim roles on a schedule
3. Limited logging and visibility
Short audit retention and quiet alerts give attackers cover. By default, Microsoft 365 retains audit logs for 90 days (E5 and add-ons extend this to 1 year+).
Fixes that work:
- Make sure Unified Audit Log is on and searchable
- Stream sign-ins and admin activity to your SIEM (or at least review them weekly)
- Monitor for:
- Unusual inbox rules
- Large numbers of file changes (possible ransomware)
- New third-party app connections
4. Backups: what Microsoft does (and doesn’t) cover
One of the biggest myths: “Microsoft backs up everything automatically.”
Not quite. Yes, you get:
- File version history
- Recycle bins
But those aren’t true backups. They don’t help if:
- Ransomware encrypts everything
- A deletion goes unnoticed for weeks
- You need to restore data from months or years ago
Microsoft does build in redundancy across its datacenters, but that’s not the same as having a backup you control and can restore from any point in time.
What to look for in a real backup service:
- Daily incremental backups stored offsite (outside Microsoft’s cloud)
- Ability to restore entire mailboxes, [Teams](https://www.sirkit.ca/blog/introducing-the-new-microsoft-teams) chats, OneDrive/SharePoint sites, or single files
- Retention that matches your compliance requirements
The takeaway is simple: Microsoft builds the foundation, but it’s up to you to make sure it’s used the right way.
Here's how you get started:
- Fill the gaps with monitoring, access controls, and proper backups
- Keep licenses aligned with your actual needs
You don’t need to do this alone. If you’re unsure whether your Microsoft 365 environment could [withstand a ransomware attack](https://www.sirkit.ca/cybersecurity), Sirkit can help. Our [Managed IT Services team](https://www.sirkit.ca/managed-it-services) closes these gaps, tests recovery plans, and keeps you compliant.
You might be interested in:
[Unveiling the Future of Work: Meet Microsoft 365 Copilot!](https://www.sirkit.ca/blog/microsoft-365-copilot-ultimate-guide-features-benefits)
[The New Vendor Fraud Playbook (and How to Stop It)](https://www.sirkit.ca/blog/vendor-fraud)
**Tags:**
[Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
### Related Posts
##### [ Cyber-Security Advisories • May 22, 2026 What Is Agentic AI in Cybersecurity? 6 min read](https://www.sirkit.ca/blog/what-is-agentic-ai-in-cybersecurity)
##### [ Knowledge Base (KB) • Jan 12, 2026 What Does Cyber Insurance Cover 5 min read](https://www.sirkit.ca/blog/what-does-cyber-insurance-cover)
##### [.jpg?width=520&height=294&name=scott-graham-5fNmWej4tAA-unsplash%20(1).jpg) Cyber-Security Advisories • Oct 9, 2025 What is a vCIO? Do you Need One? 2 min read](https://www.sirkit.ca/blog/what-is-vcio)
### Stay connected.
Join our newsletter to stay informed with the latest technology insights, market and business updates, and Sirkit news and events.
###### Categories
- [Cyber-Security Advisories](https://www.sirkit.ca/blog/tag/cyber-security-advisories)
- [Technical Pro-tips and How-to](https://www.sirkit.ca/blog/tag/technical-pro-tips-and-how-to)
- [Knowledge Base (KB)](https://www.sirkit.ca/blog/tag/knowledge-base-kb)
- [SIRKit News](https://www.sirkit.ca/blog/tag/sirkit-news)
- [Product Reviews](https://www.sirkit.ca/blog/tag/product-reviews)
###### Recent Posts
- [6 AI-Related Cybersecurity Risks Businesses Can’t Ignore](https://www.sirkit.ca/blog/ai-related-cyber-risks)
- [What Is Agentic AI in Cybersecurity?](https://www.sirkit.ca/blog/what-is-agentic-ai-in-cybersecurity)
- [AI Cyber Attacks: What Business Leaders Need to Understand Right Now](https://www.sirkit.ca/blog/ai-cyber-attacks-business-leaders)
- [Vulnerability Assessment vs Penetration Testing](https://www.sirkit.ca/blog/vulnerability-assessment-vs-penetration-testing)
- [Why MFA Alone Is No Longer Enough: How to Prevent Token Theft and AiTM Attacks](https://www.sirkit.ca/blog/prevent-token-theft)
[](https://www.sirkit.ca)
[1-780-758-5200](tel:17807585200) (Support)
[1-587-404-9002](https://www.sirkit.ca/blog/15874049002) (Sales)
Unit 217, 236 91 Street SW
Edmonton AB, T6X 1W8
- [Managed IT Services](https://www.sirkit.ca/managed-it-services)
- [Cybersecurity](https://www.sirkit.ca/cybersecurity)
- [About Us](https://www.sirkit.ca/about)
- [Contact Us](https://www.sirkit.ca/contact)
©2026 Sirkit. All rights reserved. [Privacy Policy](https://www.sirkit.ca/privacy-policy) | [Terms of Use](https://www.sirkit.ca/terms-of-use)
Sirkit® is a registered trademark.
-
-
-
×
×
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Kris Wilkinson",
"url" : "https://www.sirkit.ca/blog/author/kris-wilkinson"
},
"dateModified" : "2026-02-17T16:08:40.376Z",
"datePublished" : "2025-09-19T18:18:15.000Z",
"headline" : "Ransomware and Microsoft 365: the Complete Guide",
"image" : [ "https://www.sirkit.ca/hubfs/Ransomware%20and%20Microsoft%20365.png" ],
"mainEntityOfPage" : {
"@id" : "https://www.sirkit.ca/blog/ransomware-and-microsoft-365",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://www.sirkit.ca/hubfs/Logos/SirkitBadge%20(2).png"
},
"name" : "Sirkit"
}
}
```