Diagram showing Microsoft 365 breach path

What the WA Government Microsoft 365 Incident Teaches Us About Preventable Breach Paths

The Western Australia Office of the Auditor General recently highlighted several weaknesses in Microsoft 365 security controls across state entities. The reported outcomes included financial loss through invoice fraud and the exposure of sensitive child-related data, but what makes the report especially useful is not the novelty of the technology involved. It is the familiarity of the pattern.

Nothing described in the report depends on a novel attack technique. Instead, the findings reflect a path that security teams repeatedly encounter in cloud environments: a sequence of weaknesses that might each appear manageable in isolation but together form a successful breach chain. This was not necessarily the catastrophic failure of one control so much as the quiet accumulation of several smaller gaps.

A familiar cloud attack path

Although the public reporting focuses on outcomes, the control gaps described align closely with a familiar Microsoft 365 compromise sequence. A simplified version of that attack chain looks something like this:

Credential theft ↓ Weak MFA allows login ↓ Attacker registers new MFA method ↓ Mailbox persistence established ↓ Inbox monitoring and rule creation ↓ Invoice fraud or data access

None of these steps necessarily requires the exploitation of a software vulnerability. They depend instead on configuration gaps and incomplete security controls, a distinction that matters because it means much of the breach path can be disrupted with controls the platform already provides.

Where the controls broke down

The Auditor General highlighted several recurring issues across state entities. Each is relatively common in a large Microsoft 365 environment, but in combination they can create multiple viable entry points and persistence paths for an attacker.

Phishable MFA methods

Many environments rely on authentication methods such as SMS, voice calls, or email-based codes. Although these may satisfy an MFA requirement, they remain vulnerable to phishing, interception, and social engineering. Modern identity attacks increasingly target the authentication process itself rather than attempting to defeat an identity platform directly.

Legacy authentication exposure

Legacy authentication protocols lack support for modern protections such as Conditional Access policies. If they remain enabled, they can become a bypass path around identity protections that appear comprehensive when viewed only through the modern authentication flow.

Weak privileged access controls

Standing administrative privileges increase the impact of an identity compromise. If the affected identity already holds elevated permissions, an attacker may gain immediate control over tenant resources without needing a separate privilege-escalation step.

Limited monitoring and detection

Delayed detection can significantly increase the impact of a breach. In several cases described in the report, indicators of suspicious activity were either missed or investigated too slowly. The depth and speed of detection often determine whether a compromise remains a contained security event or develops into a major incident.

Incomplete data protection coverage

Data protection policies were not consistently applied across Microsoft 365 workloads. Coverage gaps between Exchange, SharePoint, OneDrive, Teams, and Power Platform can create exfiltration paths that are easy to overlook when each workload is reviewed separately.

Why these failures are common

None of these issues reflects a lack of security features in Microsoft 365. The platform includes mature controls for identity protection, data protection, and threat detection; what often fails is the consistency of their implementation.

Large environments accumulate configuration drift over time. Temporary exceptions become permanent, and controls are deployed partially or unevenly across workloads. Eventually, enough of those small gaps may align to create a usable path. Attackers do not always need to defeat the cloud platform itself when they can find the policy that was never fully enforced.

The practical lesson

The most useful takeaway from the WA findings is that every likely breach step should map to both:

  • a preventative control
  • a detective control

If an attacker can move from credential theft to mailbox persistence without encountering either type of control, the environment probably has a meaningful gap. Cloud security often fails not because protections are unavailable, but because the available controls have not been applied consistently across the whole path.

Closing thought

Microsoft 365 has evolved into one of the most security-capable enterprise platforms available, but like any powerful platform, its effectiveness depends on how consistently its controls are implemented. The WA findings are not unique to government. They are a reminder that security failures rarely come from a single missing feature; more often, they emerge from the quiet accumulation of configuration gaps that organisations assumed were already covered.

References