Office 365 is widely used however, is rarely configured to best practices which can allow a multitude of attacks/exploitation.

Use this security hardening guide.