The cloud misconfigurations we keep seeing

Almost every posture assessment we run starts with the same hour: exporting the settings of Microsoft 365, Entra ID and the AWS accounts, and comparing them with a benchmark. The gaps found vary little from one organization to the next. It is not a lack of skill; it is what happens when an environment grows without a baseline.

What the sources say

The Center for Internet Security (CIS) publishes the CIS Benchmarks, prescriptive configuration guides developed by consensus among volunteer experts, vendors and community members, distributed free of charge in PDF format. According to the CIS page, more than a hundred guides cover more than twenty-five product families, including the AWS, Azure, Google Cloud and Microsoft 365 foundations. Each recommendation is classified into two profiles: Level 1, a base recommendation that can be implemented promptly with minimal impact on operations, and Level 2, defense in depth for sensitive environments, some of whose measures can hinder operations if applied without care.

Microsoft Learn describes the Entra ID security defaults: registration of all users for multifactor authentication, mandatory MFA for administrators, blocking of legacy authentication protocols (clients without modern authentication, IMAP, SMTP, POP3), blocking of device code flow, and MFA for access to the Azure portal and administration tools. Microsoft states there that, based on its observations, more than 99.9% of common identity attacks are stopped by MFA and the blocking of legacy authentication, and that most compromising sign-in attempts still come from legacy authentication. The same page recommends two cloud-only emergency access accounts, reserved for break-glass scenarios.

The AWS documentation on IAM best practices asks that humans access through federation with temporary credentials, that workloads use roles rather than long-term access keys, that MFA be required wherever an IAM user or the root user remains, that least privilege be applied, that unused users, roles and credentials be reviewed and removed regularly, and that public or cross-account access to resources be verified with IAM Access Analyzer.

Why it matters

Here, with no figures because we do not publish any, are the gaps we find most often.

Microsoft 365 and Entra ID. Legacy authentication is still allowed for "a multifunction printer" or "an old script", which bypasses MFA for the whole domain. Emergency access accounts do not exist, or exist with MFA tied to a former administrator's phone. Global administrator roles are permanently assigned to accounts used every day. User consent to applications is open. SharePoint external sharing is allowed to anyone, with no expiry. Audit logs are not kept beyond the default value.

AWS. The root user has active access keys. IAM users with access keys several years old serve integrations nobody can name. Policies grant full access to an entire service for lack of being reduced after the discovery phase. CloudTrail is not enabled in every region, or its files sit in a bucket the same role can delete. S3 buckets remain publicly accessible because the block was not applied at the account level.

None of these gaps is exotic. Each one appears in the corresponding CIS Benchmark, at Level 1 for most. They persist because nobody has the responsibility of comparing the configuration with the benchmark, and because the fixes sometimes break something nobody wants to repair.

What we think at Sentrix

The right answer is not one more tool; it is a baseline that is chosen, measured and kept.

1. Adopt the CIS Benchmark of each platform at Level 1 as the internal baseline, and document every exception with an owner and a review date.
2. Measure before fixing: a first complete export, compared with the benchmark, gives the list of gaps and the starting point the auditor will want to see.
3. Fix the gaps that bypass MFA first: blocking of legacy authentication and device code flow in Entra ID, MFA on the root user and the remaining IAM users in AWS.
4. Remove long-term credentials: federation and temporary roles in AWS, managed identities for Azure workloads, and rotation of what cannot be replaced.
5. Close public access by default, at the account or organization level, then explicitly reopen what must be, with the written justification.
6. Automate the comparison: a monthly export compared with the benchmark, where new gaps create a ticket with an owner. That is the role of a continuous threat exposure management module, like the one in the Sentrix platform.

For ISO 27001:2022, these measures answer controls 8.9 (configuration management), 8.5 (secure authentication) and 5.23 (information security for use of cloud services); for SOC 2, criteria CC6.1 to CC6.3. See the ISO 27001 framework page and our cloud security service.

The next step

Export the state of legacy authentication from the Entra ID sign-in logs and the list of IAM access keys with their last-used date. These two lists take an hour to produce and contain, almost always, the first two gaps to fix.