.svg){kind=small}
An attacker may already be inside your Microsoft 365 tenant, and nothing in your alerts would tell you.
A user who only ever logs in from Utah signs in from New Jersey. Nobody notices for two days. Then a phishing blast goes out from their mailbox, and the logs show the attacker spent those two days searching for invoices and ACH details.
For many IT teams, the question is not whether a Microsoft 365 account will be compromised. It is how long the compromise goes unnoticed. Business email compromise (BEC) drove an estimated $3 billion in reported losses in 2025, and the real number is likely far higher. Today's attackers blend in with normal sign in activity, which makes them easy to miss.
Catching these attacks starts with understanding how account takeover works today, which signals reveal it, and which hardening steps reduce your exposure in Microsoft 365.
Why Microsoft 365 Security Alerts Miss Compromised Accounts
Compromised Microsoft 365 accounts often go undetected because attackers use stolen tokens, register devices that pass compliance checks, and sign-in from the same city as the real user. Most alerts focus on the sign-in itself, while the real warning signs appear in what the attacker does next.
Nathan Taylor, host of Demystifying Microsoft, sat down with Nathan Ostrowski, cofounder of Petra Security, to talk through how identity attacks have changed. They cover residential proxies, SEO phishing, forensic investigation after a breach, and the hardening steps that make the biggest difference.
What is Identity Threat Detection and Response (ITDR)?
Identity threat detection and response (ITDR) is a security approach that monitors user identities for signs of account takeover and responds when an attacker gains access. In Microsoft 365, that means watching for session theft, credential theft, and malicious activity inside a mailbox, SharePoint, or Teams.
ITDR matters because identity is now the main target. According to the FBI's crime report, BEC is the costliest type of cyberattack after investment scams, and around 90% of successful attacks today involve BEC.
Once inside an account, attackers usually go after one of three things:
- Reputational harm by sending phishing emails to every contact
- Data theft by pulling files and emails from Exchange and SharePoint
- Financial fraud such as payroll theft, fake invoices, or changed payment details
Financial fraud is the most common of the three, which is why attackers often go straight for payment related emails and documents.
Why Geoblocking in Conditional Access No Longer Stops Attackers
Geoblocking in Conditional Access no longer stops most attackers because the majority of Microsoft 365 attacks now come from inside the United States. Blocking logins from outside the country or flagging known VPNs worked when attacks came from obviously foreign IP addresses, but today those rules miss most account takeover attempts.
What are Residential Proxies?
Residential proxies route traffic through real consumer devices, such as phones, smart TVs, and home routers. Many free apps and smart TV apps include software that sells the device's bandwidth while the app is open. Anyone who rents access to these network can choose from millions of normal looking home IP addresses.
To Microsoft, a login through a residential proxy looks like it came from T Mobile or Verizon in the user's own city. It does not get flagged as a VPN or proxy. Even organizations with multiple overlapping security tools can miss these logins, because they look just like the real user signing in from home.
Can Compliant Device Policies Prevent Account Takeover?
Requiring compliant devices helps, but it is not airtight. Attackers have exploited weaknesses in the Microsoft Authentication Broker to register new devices that then count as compliant, which gives them access even in tenants restricted to managed devices.
Should you Block Logins From Outside the US?
For most organizations, the answer is not as a default policy. Country blocks mostly catch attackers who are noisy enough to be spotted in other ways, while every traveling employee who gets locked out loses a little trust in the security program. A middle ground is to block only a short list of high risk countries your users are unlikely to visit.
How are Attackers Getting Into Microsoft 365 Accounts?
Attackers rarely build their own tools anymore. They buy phishing toolkits from a small, competitive marketplace. When one toolkit releases an update, tens of thousands of attackers get the new capability at once. AI has also improved phishing emails, which no longer carry the obvious spelling and grammar mistakes users were trained to spot.
These are some of the most common ways attackers get into Microsoft 365 accounts today:
|
Attack Method |
How It Works |
|---|---|
|
Token theft |
A phishing page steals the session token after the user signs in, so the attacker skips MFA |
|
Device code flow phishing |
The user is tricked into entering a code that grants the attacker access |
|
Direct Send phishing |
Emails appear to come from inside your own domain |
|
SEO phishing |
Poisoned search ads and results for "Microsoft password reset" send users to fake login pages |
What is SEO Phishing?
SEO phishing uses paid ads and poisoned search results to put fake login pages in front of users who are actively looking for help. A locked out user searches for how to reset their Microsoft password, or asks an AI assistant, and lands on a fake page. SEO phishing is estimated to account for 20% to 30% of attacks.
Warnings Signs of a Compromised Microsoft 365 Account
The clearest signs of a compromised Microsoft 365 account come from several unusual events happening within a short window, not from a single login. Watch for these patterns:
- A login from an unusual city followed by a new inbox rule
- A new device registered within minutes of that login
- Mailbox searches for financial terms like invoice, ACH, or wire
- Unusual Graph API activity or mass access to old emails and files
- File access patterns that don't match how the user normally works
Many security tools rely on simple rules, such as impossible travel or VPN detection. A login from a new state alone might not trigger an alert. A login from a new state, a new mailbox rule, and a new device registration within three minutes of each other should.
Why are Microsoft 365 Audit Logs so Hard to Investigate?
Investigating a breach by hand is slow and easy to get wrong. The Entra ID sign in logs portal is slow, and Exchange, SharePoint, and Teams activity logs do not have a simple interface for searching. These workloads also produce roughly 30 times more activity than sign ins alone. Even a small tenant can create millions of log entries over six months.
How Often do Microsoft 365 Accounts Get Compromised?
One estimate puts the rate at roughly one successful compromise per 500 identities each month. At that rate, a 100 user organization can expect at least one compromise every five months or so, and a 1,000 user organization about two per month.
If you are not seeing compromises at that rate, the access may still be there and just not used yet. Stolen sessions are often bought and sold. An attacker may get in, read about a hundred financial emails, and then wait until the access is sold to someone who acts on it.
Why does Response Time Matter After an Account Compromise?
Automated toolkits are designed to do their most valuable work within the first ten minutes of access. Detecting and shutting down a compromised session in about a minute, instead of ten, can device whether sensitive emails and documents leave the tenant.
What to Do After a Microsoft 365 Account Is Compromised
The first steps after a Microsoft 365 account is compromised are to reset the password, revoke all active sessions, and remove any inbox rules or devices the attacker created. From there, the investigation needs to confirm how the attacker got in, how long they were there, and what they accessed or sent. Manual triage often misses details, like a hidden mailbox rule or an extra registered device.
A complete forensic investigation should cover the following:
- The initial access method and timeline
- Every device the attacker registered
- All inbox rules created or changed
- Emails and files the attacker accessed
- Messages sent from the account and who received them
That full picture tells you which customers or partners to contact and which financial risks to follow up on.
How to Harden Microsoft 365 Against Account Takeover
Hardening Microsoft 365 against account takeover means closing the entry points attackers use most, from email spoofing to weak MFA. Many of the most effective changes are not disruptive. They just need to be planned and rolled out.
- Configure SPF, DKIM, and DMARC so attackers cannot easily spoof your domain.
- Turn on Microsoft's built in email filtering, which is available to all tenants.
- Disable Direct Send if you do not need it, since it accounts for a meaningful share of email based attacks.
- Block device code flow with Conditional Access for users who do not need it.
- Strengthen MFA by moving away from push notifications and toward passkeys.
- Require compliant devices to make stolen credentials harder to use.
Microsoft's default settings have not always been secure, and many tenants still run on defaults that worked fine for a decade. As attackers get faster, those defaults leave gaps. Even a well hardened tenant still needs detection and response.
may be incorrect
Closing the Gaps Attackers Use to Stay Hidden in Microsoft 365
Location rules and basic risk alerts no longer catch account takeover. Finding it now depends on correlating behavior across sign-ins, mailboxes, devices, and files, and on hardening the entry points attackers rely on most.
If you want help reviewing your tenant's identity security, hardening settings, or response plan for a compromised account, the Sourcepass MCOE team can walk through your environment with you.
For more conversations on Microsoft security, licensing, and Copilot, subscribe to Demystifying Microsoft.
