Strengthening Microsoft 365 Security for a UK Healthcare Provider
A multi-site healthcare organisation partnered with Peritus to uncover hidden risks, remediate high-impact misconfigurations, and significantly reduce its Microsoft 365 attack surface.
52%
reduction in overall attack surface following remediation
Secure
resolved high-risk misconfigurations across Microsoft 365
Aligned
improved compliance with healthcare security and access standards
1. The Challenge
The organisation — which delivers community, outpatient, and diagnostic services across multiple sites — relied on Microsoft 365 for clinical coordination, document sharing, and operational workflows. As teams expanded and service lines evolved, the environment accumulated legacy settings, inconsistent sharing rules, and identity risks that could compromise sensitive patient data or disrupt service delivery.
Key issues included:
overly permissive access
unmanaged external sharing
legacy authentication still enabled
inconsistent MFA enforcement
high-risk tenant-level misconfigurations
With sensitive healthcare data at stake, the organisation needed a clear picture of its risks and practical steps to strengthen Microsoft 365 security.
2. Our Approach
Peritus conducted a comprehensive Microsoft 365 security assessment focused on uncovering misconfigurations and improving identity, collaboration, and data protection controls.
Our work included:
Full review of identity configuration, MFA, conditional access, and privileged roles
Assessment of SharePoint, OneDrive, Teams, and external sharing exposure
Evaluation of Defender for Office 365 and threat protection settings
Mapping tenant risks against NCSC and NHS security standards
Prioritised remediation roadmap with clear technical steps
Guidance on improving ongoing governance and operational maturity
This provided leadership with clarity on where risks existed and what “good” looks like for a secure M365 environment.
3. The Outcome
Peritus delivered a measurable uplift in the organisation’s Microsoft 365 security posture:
52% reduction in overall attack surface
Removal of high-risk misconfigurations affecting identity and data access
Stronger MFA, conditional access, and identity hygiene
Reduced exposure caused by legacy authentication and external sharing
Improved alignment with healthcare regulatory expectations
A clear, actionable roadmap enabling long-term governance and continuous improvement
The organisation gained both immediate security improvements and a sustainable way to maintain strong controls moving forward.
“Peritus gave us clarity we didn’t have before. Their assessment uncovered critical risks and helped us strengthen our Microsoft 365 environment quickly and effectively. ”