The full report contains thirteen findings across security, licensing, and operational
hygiene. Below are the six that most shaped the conversation with Hartwell's leadership team.
Headline numbers preserved; identifying detail anonymised.
The incumbent IT provider's admin account had no MFA — and was signed into 17 staff workstations
High · Identity
The most material finding of the audit. The incumbent IT provider held a shared
administrative account that was excluded from the tenant's "Require MFA for all
users" policy, held permanent Global Administrator role (the highest privilege
level Microsoft 365 offers), and was configured as the Windows sign-in identity
on approximately seventeen staff workstations.
A single shared credential, no MFA enforcement, total tenant control, and already "signed in" across half the device fleet. If that one password is ever compromised — through phishing, password reuse, or a credential leak — an attacker has administrator-level access across the entire environment and is already authenticated on a large share of the laptops. This is the configuration profile of either a careless setup or a deliberate persistence mechanism. Either way, it's exactly what an attacker would leave behind.
SharePoint and OneDrive set to "Anyone" — anonymous links never expired
High · Data sharing
External sharing was configured at the most permissive setting Microsoft offers.
Anonymous "Anyone" links — which work without sign-in — never expired.
Folders shared anonymously permitted upload back into them. Twenty-nine of thirty-five
SharePoint sites had external sharing enabled at the site level.
Any staff member who has ever generated an "Anyone" link is still leaking those files today, and that link can be forwarded to anyone on the internet. Combined with no mobile device management (Finding 6 below), this constituted a meaningful data-loss exposure. The configuration profile is most commonly associated with accidental leakage, but it also represents the easiest persistent exfiltration channel for an attacker to use without trigger.
The domain was unprotected against email spoofing
High · Email security
The domain's DMARC policy was set to p=none — a monitoring-only
configuration that allows receiving mail servers to report on unauthenticated mail
but does not block it. In practical terms: a scammer in another country could send
a perfectly legitimate-looking invoice or HR email from anyone@<Hartwell's domain>
to Hartwell's customers, suppliers, or staff — and major email providers (Gmail,
Outlook) would deliver it normally.
This is the leading vector for business email compromise (BEC) fraud against Australian SMBs. For a wholesale business with regular external supplier and customer correspondence, this is also the configuration that allows fraudulent payment-redirect emails to land convincingly.
The malware defences in their Microsoft licences had not been switched on
High · Endpoint
Hartwell's Microsoft 365 Business Premium subscription included Microsoft
Defender preset security policies — protections specifically designed to
block the malware patterns used in over 90% of real-world attacks against
businesses this size. None had been enabled. No Attack Surface
Reduction rules had been deployed.
They were paying Microsoft for the capability and not getting the benefit. The Microsoft Secure Score top-recommended actions for the tenant were all ASR rules — controls that block well-known malware delivery patterns such as Office applications creating executable content, Win32 API calls from macros, and credential theft from the LSASS process. The protections cost nothing extra; they had simply not been turned on.
$3,670/yr in unused licences — recoverable inside the four-week renewal window
High · Licensing
Fourteen user accounts held paid Microsoft 365 licences but were not active users.
They included disabled ex-staff accounts (some inactive for 1-4 years), accounts
that had never been signed in (including one new-starter account with two stacked
licences worth $533/yr that had never been used), and Teams Phone service accounts
using paid user licences rather than free resource-account licences. The tenant
was also over-assigned (35 users, 33 paid Business Premium licences) — Microsoft had
already flagged this for billing at the next renewal.
Business Premium
5
$1,998
Exchange Online (Plan 1)
4
$298
Teams Phone Standard
2
$266
Unused Business Standard seat
1
$228
Immediate licence cleanup
17
~$3,670
Staff phones accessing company email were not managed at all
High · Endpoint / Data
Microsoft Intune — included in Business Premium licences — had zero mobile
devices enrolled. Every iPhone or Android device staff used to read company
email was completely unmanaged: no enforced screen lock, no remote-wipe capability
when a device was lost, no separation of work data from personal data, no audit trail
of which devices held company information.
Combined with the permissive external sharing posture, this constituted a substantial data-loss exposure: a forgotten phone in a taxi could expose company data with no way to retrieve it. The relevant Intune capability was already paid for and merely had to be turned on.
