40% of enterprises experienced Office 365 credential theft, report finds