Entra ID, MFA, Conditional Access, token theft, and privileged access. Identity is the number one breach vector in Microsoft 365 and the first pillar of tenant security.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
SMS codes, push notifications, and passkeys all count as MFA, but they do not stop the same attacks. Here is the strength hierarchy, what defeats each tier, and the upgrade path to phishing-resistant.
The exclusion added during a migration, the policy stuck in report-only, the tenant that never got the baseline. Here are the gaps attackers find first, and the 16-policy baseline that closes them.
Microsoft-managed Conditional Access policies land in tenants automatically, Entra ID preps device-bound passkeys, Ignite floods Teams with Copilot, and Intune unveils two paid add-on capabilities.
PIM extends just-in-time access to groups with Conditional Access enforcement, Graph activity logging enters preview, Windows Server 2012 R2 hits end of support, and Teams stacks up eight features.
Azure AD gains IPv6 support that can break location-based Conditional Access, GDAP milestones shift with an update promised by February 15, cross-tenant sync previews, and Teams retires the wiki.
Microsoft sets a February 27, 2023 date to enable Authenticator number matching by default, Teams Premium adds Advanced Virtual Appointments, users can delete chats, and SharePoint URL rename hits GA.
Azure AD P2 auto-remediates risky users; P1 only detects them. This Power Automate flow sweeps every customer tenant for risk detections and opens a PSA ticket the moment a new one lands.
Five Azure AD MFA controls most tenants never touch: number matching, location context, authentication strengths, and two registration reports that catch attacker-added MFA methods.
June 2022 for MSPs: Temporary Access Pass reaches GA for passwordless onboarding, Microsoft walks back the July 11 legacy CSP renewal block, and Teams ships seven features.
Pair Azure AD PIM with GDAP security groups and your techs activate customer access for a few hours instead of holding it forever. The full 2022-era setup, screenshot by screenshot.
