Microsoft product
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
Teams Premium flags sensitive content during screen sharing, Purview meters GenAI data security as pay-as-you-go, and Copilot lands across PowerPoint, Forms, and calls.
Exchange Online enforces tenant-wide outbound email limits, E5 Security arrives as a Business Premium add-on, and the Report Message add-in enters maintenance mode.
Microsoft-managed Conditional Access policies start auto-enforcing after 45 days, Skype interop in Teams dies May 1, and Hotpatch hits preview. The February 2025 changes, sorted by deadline.
Copilot Chat arrives free for Entra users, Teams flips transcription on by default for new tenants, and small businesses get live chat. The January 2025 M365 changes, sorted by what to check first.
New Outlook migration turns opt-out for SMBs in January 2025, monthly billing on annual terms gets a 5% markup, Viva Goals gets a retirement date, and Teams ships ten quality-of-life features.
By default, anyone with a Microsoft 365 tenant can open a Teams chat with your users. Here is the attack that exploits it and the four controls that break the kill chain.
Microsoft 365 email is not phishing-resistant by default. SPF/DKIM/DMARC, a tuned anti-phishing policy, Safe Links and Attachments, external sender tags, and keyword mail flow rules close the gap.
Copilot picks up enterprise data protection and usage APIs, Autopatch and WUfB-DS merge into one service, Entra ships AiTM detection and FIDO2 provisioning, and Teams adds CAPTCHA for anonymous joins.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
Copilot for Security goes GA April 1 with pay-as-you-go pricing, NCE subscriptions become transferable mid-term, Restricted SharePoint Search arrives, and Teams ships voice isolation.
