More importantly, using Microsoft at scale can leave your organization fundamentally insecure. The obscure, insecure defaults are, at best, dangerous missteps and, at worst, borderline negligent. I’m convinced that only a small fraction of enterprises using Microsoft have the expertise and budget required to secure it properly.
My personal view is that if your organization depends heavily on Microsoft, it’s not serious about security, whether they’re aware of it or not.