Office 365 user security practices are woeful, yet it's still 'Microsoft's fault' when an org is breached

As soon as defences are sold as a product, hygiene suffers

The US Cybersecurity and Infrastructure Security Agency (CISA) has become the latest government body to plead with admins to implement security best practices on Microsoft's Office 365 platform."