[wolverine876]

A valid point - you can't match Microsoft's resources and in-house expertise.

But you are probably a much less appealing target. Also, you might be willing to lock it down more than Microsoft, which has to please all those millions of customers and wants to admin it at the lowest cost possible - including possibly minimizing support calls by using permissive settings - and not with the most security possible.

[ocdtrekkie]

Indeed, one of my favorite inconvenient truths is that geo-blocking remains one of the most effective, and essentially free attack surface reductions you can make.

If all your staff are in a country, there's no reason for your internal tools to be accessible from any other country. If all of your customers are in a country, there's no reason for any of your web presence to be accessible from any other country.