An attacker does not need your password if they already have your session token. After they get in, they rarely make noise. They read email quietly, set up inbox rules to hide replies, and wait for an invoice or wire request worth intercepting. Many organizations does not find out until weeks later, often when a vendor asks why a payment never arrived.
Identity threat detection and response (ITDR) is built to close that gap. It does not only try to block sign-ins. It watches what happens after someone authenticates and responds automatically when an account starts acting like it has been taken over. MFA alone won't stop every Microsoft 365 account takeover. ITDR closes that gap by detecting compromised accounts early, spotting the warning signs, and fitting into a broader Microsoft 365 security strategy. Petra ITDR shows how that works by detecting, remediating and documenting identity attacks, as it did in response to the recent ConnectWise Cloud Backup (formerly SkyKick) supply chain incident.
In this episode of the Demystifying Microsoft Podcast, Nathan Taylor gives a live walkthrough of the Petra ITDR platform. He opens an incident timeline, steps through the remediation workflow, and reviews the reports Petra produces for leadership, insurers, and incident response teams.
ITDR is a category of security tools that continuously monitors user identities for signs of compromise and acts when it finds one. Attackers now aim most of their effort at the identity layer through business email compromise (BEC), phishing, and token theft. As a result, identity monitoring has become a core part of Microsoft 365 security.
An ITDR platform pulls activity data from across the environment, correlates it, and responds automatically when an account looks compromised. The automation matters because attacks do not keep business hours. A token stolen on Friday afternoon may not be used until 1 a.m. Sunday, when nobody is watching.
Legitimate users follow predictable patterns. Attackers move fast once they are in, because their first goal is to keep their access. Common indicators include:
Any one of these might be harmless. Several in quick succession usually are not. Spotting that sequence across thousands of log entries is the work ITDR automates.
MFA stops most password-based attacks, but token theft gets around it completely. If an attacker captures a session token after the user completes MFA, they can replay that token and sign in as the user. Phishing kits sold on the dark web make this technique easy to get, and AI is making phishing lures more convincing and consistent.
That's why Sourcepass recommends a layered order of operations:
Petra ITDR connects to your Microsoft 365 tenant and monitors account activity around the clock. It does not rely only on where a sign-in comes from. Instead, it looks at what an account does after it signs in. It connects signals like new device registrations, newly added MFA methods, inbox rules and Microsoft Graph activity to spot an account takeover, even when the attacker has already passed MFA.
When Petra confirms a compromise, it can revoke sessions, lock the account and remove the backdoors the attacker left behind. It then builds a timeline showing how the attacker got in, what they accessed and when they were removed.
Onboarding starts when you approve an OAuth connection to your tenant. Read-only access is enough for an assessment. 24/7 protection needs additional permissions so Petra can take remediation actions. Log collection usually finishes in four to six hours, and correlation and analysis take another 24 to 48 hours.
Depending on your logging configuration, Petra usually ingests about six months of historical data, so it can surface compromises that happened before deployment. Sources include:
Some small business tenants generate 14 to 15 million log entries, which is far more than anyone can review by hand.
It is both. Petra relies mainly on automated, AI-driven detection models, and human analysts step in when an incident reaches a higher severity.
Petra flagged the following incident in a sample tenant. It matches a pattern Sourcepass sees often when responding to real compromises:
Weeks of undetected access is common. Many organizations only realize something is wrong after outside activity forces the question.
This attacker connected through a residential proxy. That is a network that routes traffic through internet-connected home devices such as smart TVs, cameras, robot vacuums, and refrigerators, some of which sell bandwidth to third parties. With these networks, an attacker's sign-in can look like it comes from a home near your office instead of an overseas IP address, so it slips past location-based alerts. Behavior-based detection catches what location checks miss.
Containing a compromise takes more than a password reset. Petra generates a remediation checklist for each incident, which can include:
Skipping one step can leave the attacker a way back in, so a consistent checklist matters as much as fast detection.
After a compromise, leadership, cyber insurers, law enforcement, and sometimes regulators all want the same answers: how the attacker got in, what they accessed, how long they had access, and when they were removed. Piecing that together by hand in Microsoft's portals is slow, especially in the Entra sign-in logs, and it takes real forensic skill.
Petra builds a full timeline of the emails and files the attacker accessed, sent, modified, or deleted, and you can export it to CSV. It also provides these reports:
Starting around October 15, 2026, attackers compromised enterprise applications used by ConnectWise Cloud Backup, formerly SkyKick Cloud Backup. The keys and tokens they obtained let them impersonate those apps and get into customer Microsoft 365 tenants. Because the entry point was a trusted vendor and not the customer, this was a supply chain attack.
ConnectWise's remediation guide recommends three steps: disable the affected enterprise applications, preserve incident evidence, and review sign-in and audit logs for indicators of compromise, especially activity from the IP addresses tied to the attack. Far more tenants had the apps installed than actually saw attacker activity. Every organization still has to confirm which group it is in, and that log review takes time and expertise.
Petra automatically disabled the affected ConnectWise and SkyKick enterprise apps across protected tenants. One older tenant had eight of them. Petra then searched each tenant's existing logs for the known indicators of compromise and issued a report confirming whether any unauthorized data access or exfiltration had happened. The logs were already collected and indexed, so organizations got a clear answer without having to run their own investigation.
Identity is now the main battleground in Microsoft 365. Licensing and hardening make it harder for attackers to get in. ITDR decides how quickly you find them and how completely you remove them. The organizations that recover best can quickly answer three questions: Is anyone in our tenant who should not be? Have we closed every way back in? Can we prove what was accessed?
Not sure whether your tenant was exposed in the SkyKick incident? Sourcepass MCOE offers a complimentary Petra ITDR scan to check for signs of compromise and walk you through the results. Contact our team to discuss ITDR, tenant hardening, or your overall Microsoft 365 security posture.