Sophos warns of two ransomware groups abusing Microsoft 365 services and default configurations to contact internal enterprise users.