Topic
When customers demand BYOD access to Microsoft 365, contain it: web-only access, download blocks, session limits, TAP-gated enrollment, and MAM, with a dynamic group to segment personal devices.
Token replay attacks grew over 111% year over year and walk straight past MFA. Device compliance, strict location enforcement, token binding, and risk-based blocking form the foundation.
Geo-blocking Conditional Access creates a ticket every time a user travels. This Forms plus Power Automate build grants time-boxed access to approved countries, then revokes it automatically.
July 2024 ships the new Microsoft Entra Suite, auto-enables Microsoft-managed MFA Conditional Access policies, archives unlicensed OneDrive accounts after 90 days, and adds dynamic watermarking and scheduled Copilot prompts.
Two accounts, a 32-character split password, FIDO2 keys, one Conditional Access exclusion, and an alert on every sign-in. The full checklist for Microsoft 365 emergency access accounts.
Three overlapping enforcement systems and no central report make MFA coverage in Microsoft 365 genuinely hard to prove. Here is what insurers will eventually demand and how to produce it.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
SMS codes, push notifications, and passkeys all count as MFA, but they do not stop the same attacks. Here is the strength hierarchy, what defeats each tier, and the upgrade path to phishing-resistant.
Personal-device access does not have to be negotiated client by client. Define three BYOD support tiers once, then deploy the matching Conditional Access, MAM, and DLP stack everywhere.
The exclusion added during a migration, the policy stuck in report-only, the tenant that never got the baseline. Here are the gaps attackers find first, and the 16-policy baseline that closes them.
Copilot for Security goes GA April 1 with pay-as-you-go pricing, NCE subscriptions become transferable mid-term, Restricted SharePoint Search arrives, and Teams ships voice isolation.
