Microsoft 365 is close to universal in the AEC sector, but a licence is not a configuration. When we review tenants for new clients, the same handful of problems appear again and again, most of them invisible until they cause a security incident or a data-loss headache.
1. Multi-factor authentication left optional
Compromised passwords remain the most common way into a business. If MFA is not enforced for every account, including partners and directors, who are the most valuable targets, the tenant is one convincing phishing email away from trouble.
2. SharePoint sprawl with no information architecture
Project collaboration works dramatically better when there is a deliberate structure: consistent project site templates, sensible permissions inheritance and a naming convention that matches how the practice actually numbers projects.
Without that, practices end up with hundreds of ad-hoc sites, duplicated documents and permissions nobody can explain.
3. No retention or backup strategy
Microsoft operates the service, but responsibility for your data remains yours. Retention policies, versioning settings and third-party backup should be deliberate decisions, not defaults, particularly for practices with contractual document-retention obligations.
4. Everyone is an administrator
Global admin rights accumulate over time and rarely get removed. Admin access should be limited, role-based and protected with the strongest authentication available, attackers who land an admin account own the entire tenant.
5. Licensing bought once and never reviewed
Practices change size and shape; licence assignments usually do not. An annual review of plans against actual usage regularly recovers meaningful budget and often reveals security features already being paid for but not switched on.
A well-run tenant is not a project, it is a discipline. That is exactly what a specialist managed service is for.