I have some discussions with my work mates about how safe is SharePoint Online login. I think it is just as DropBox, FaceBook or any other application with a form. I know that Office 365 uses OAuth2 and that means a separation between the application and the provider and that solves one part of the problem. But, what about the client side?

Always I've been asked about this I say that having a SharePoint farm in Azure VM and connected via VPN is more secure than SharePoint Online (IaaS vs SaaS) because I understand that SharePoint Online is not safer.

  • Could we have some leves of security?
  • How can we measure that?
  • How can we take a decision knowing the weak points?

Please, could you throw some light on this issue?


From a home/personal Office 365 stand point, yes it would be similar to any other internet service that if your password is compromised, then someone can get into your tenant.

However, any business that is using Office 365 is highly likely to be synchronizing objects from local Active Directory to SharePoint, and therefore you are using auth credentials from your network. This is typically handled by ADFS or third party auth providers.

What that means then is that when you try to hit any of the Office 365 workloads, they see you are from a domain that uses their own authentication mechanism. When on your network, you pass through pretty seamlessly. When you are off your network, you get presented with your organization's or third party's auth screen and then get redirected to the desired workload. If you fail that auth, you don't get in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.