microsoft 365 operational risk