The Exchange Online security controls organizations keep getting wrong

This interview with an Exchange Online expert outlines responsibilities under the cloud Shared Responsibility Model and highlights operational security gaps — notably legacy authentication (SMTP AUTH, POP, IMAP), audit log blind spots (client-side rules, legacy protocol access, token replay), the necessity of identity/access controls (Conditional Access, PIM, MFA with proper configuration), continuous monitoring, and when third-party email gateways may or may not add value.