Most Microsoft 365 tenants in Regina look secure at a glance. They have MFA for some users, a handful of Conditional Access policies, and an admin assumption that Microsoft has the rest covered. That assumption is where the trouble starts. What usually sits underneath is a mix of legacy authentication