Entra ID, MFA, Conditional Access, token theft, and privileged access. Identity is the number one breach vector in Microsoft 365 and the first pillar of tenant security.
Entra lets any user register any device by default, and attackers use that to persist after a compromise. Three policies, from MFA on registration to TAP gating, shut the door.
Microsoft 365 lets users sign in from any device in the world by default. Here are the two Conditional Access policies, exact settings included, that restrict access to devices you manage.
When customers demand BYOD access to Microsoft 365, contain it: web-only access, download blocks, session limits, TAP-gated enrollment, and MAM, with a dynamic group to segment personal devices.
Token replay attacks grew over 111% year over year and walk straight past MFA. Device compliance, strict location enforcement, token binding, and risk-based blocking form the foundation.
Geo-blocking Conditional Access creates a ticket every time a user travels. This Forms plus Power Automate build grants time-boxed access to approved countries, then revokes it automatically.
Rotation, JIT elevation, audit logging, and a plan for the two moments admin rights actually get used. The full governance picture for local admin accounts, first party and third party.
July 2024 ships the new Microsoft Entra Suite, auto-enables Microsoft-managed MFA Conditional Access policies, archives unlicensed OneDrive accounts after 90 days, and adds dynamic watermarking and scheduled Copilot prompts.
Two accounts, a 32-character split password, FIDO2 keys, one Conditional Access exclusion, and an alert on every sign-in. The full checklist for Microsoft 365 emergency access accounts.
Three overlapping enforcement systems and no central report make MFA coverage in Microsoft 365 genuinely hard to prove. Here is what insurers will eventually demand and how to produce it.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
SMS codes, push notifications, and passkeys all count as MFA, but they do not stop the same attacks. Here is the strength hierarchy, what defeats each tier, and the upgrade path to phishing-resistant.
