Topic
Business Standard saved one firm $200 a month until a token-theft phish cost them $18,000. The MSP playbook for the Standard to Premium renewal conversation: outcomes, pillars, and objection answers.
Entra flags risky users by default, but nobody gets told and nothing happens without P2. How to route risk detections to your PSA and the one policy that prevents most compromises.
Token theft via AiTM phishing hit 51% of webinar respondents in the past year. Five layered controls, from Defender tuning to attack disruption, break the kill chain at each stage.
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
A malicious OAuth app keeps mailbox access after every password reset. How attackers plant them in Microsoft 365, plus the consent lockdown and hunting runbook.
Microsoft 365 email is not phishing-resistant by default. SPF/DKIM/DMARC, a tuned anti-phishing policy, Safe Links and Attachments, external sender tags, and keyword mail flow rules close the gap.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
June 2021 for MSPs: E2EE arrives for 1:1 Teams calls, meetings can auto-record, recordings become searchable by transcript, and the first contact safety tip moves into anti-phishing policy.
