Here's my top 20 weaknesses in M365 based on experience consulting. I've seen most of these everywhere in varying mixtures. Public groups has been a problem in all but one org I've worked with. 1. Public Groups expose sensitive data 2. Upload from unmanaged devices 3. Download from unmanaged devices 4. Lack of CAPs to block device code phishing 5. Lack of CAPs and configurations to mitigate AITM 6. OneDrive sync allowed from unmanaged devices 7. Ability to sync cloud storage to other 3rd party drives and vice versa 8. Anyone links in OneDrive and SharePoint 9. Legacy SharePoint IRM on sites and document libraries and Teams (classic) sites 10. Non-existant App Governance 11. Lack of governance or data security on Power Platform Connectors 12. Lack of license by request for Power Platform Apps 13. Teams apps sprawl 14. Anon users allowed to chat in Teams 15. Excessive API permissions in vendor apps 16. Ungoverned 3rd party AI 17. Lack of DLP on Microsoft Cloud Services 18. Lack of Safelinks in office365 apps aside from email 19. Lack of safe attachments in m365 apps outside email 20. Lack of phishing resistant authn