Entra ID, MFA, Conditional Access, token theft, and privileged access. Identity is the number one breach vector in Microsoft 365 and the first pillar of tenant security.
The Microsoft 365 E5 Security add-on brings five standalone security products to Business Premium for $12 per user. Six business scenarios show where the value lands.
Entra flags risky users by default, but nobody gets told and nothing happens without P2. How to route risk detections to your PSA and the one policy that prevents most compromises.
Token theft via AiTM phishing hit 51% of webinar respondents in the past year. Five layered controls, from Defender tuning to attack disruption, break the kill chain at each stage.
Six Conditional Access policies can stop token theft before it starts. Each blocks a different part of the attack, and each has a gap. Here is the full comparison with exact settings.
Entra's token protection session control sounds like the end of token replay. In testing, stolen tokens still replay in the browser. Here is exactly what the preview covers, as of May 2025.
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
A malicious OAuth app keeps mailbox access after every password reset. How attackers plant them in Microsoft 365, plus the consent lockdown and hunting runbook.
Most businesses cannot produce an accurate application inventory, and the Microsoft 365 defaults make it worse. Here is the layered plan for CIS Control 2, from OAuth consent to ASR rules.
Microsoft-managed Conditional Access policies start auto-enforcing after 45 days, Skype interop in Teams dies May 1, and Hotpatch hits preview. The February 2025 changes, sorted by deadline.
Entra keeps sign-in logs for 30 days at most, 7 on the free tier. Here is how to stream them into a Log Analytics Workspace and keep up to two years of evidence, usually for pocket change.
Microsoft blocks 7,000 password attacks per second, yet only 41% of Entra sign-ins use MFA. The data behind the passwordless push, and an honest look at what the passkey experience is like today.
External collaborators do not need download rights to do their job. Two settings force guests into authenticated, browser-only access and block local downloads in SharePoint and OneDrive.
