Topic
Microsoft blocks 7,000 password attacks per second, yet only 41% of Entra sign-ins use MFA. The data behind the passwordless push, and an honest look at what the passkey experience is like today.
By default, anyone with a Microsoft 365 tenant can open a Teams chat with your users. Here is the attack that exploits it and the four controls that break the kill chain.
Entra lets any user register any device by default, and attackers use that to persist after a compromise. Three policies, from MFA on registration to TAP gating, shut the door.
Token replay attacks grew over 111% year over year and walk straight past MFA. Device compliance, strict location enforcement, token binding, and risk-based blocking form the foundation.
Copilot Wave 2 ships Pages, Python in Excel, and SharePoint agents; Microsoft starts enforcing MFA for admin portals on October 15, 2024; Teams and Intune stack up quality-of-life updates.
July 2024 ships the new Microsoft Entra Suite, auto-enables Microsoft-managed MFA Conditional Access policies, archives unlicensed OneDrive accounts after 90 days, and adds dynamic watermarking and scheduled Copilot prompts.
Two accounts, a 32-character split password, FIDO2 keys, one Conditional Access exclusion, and an alert on every sign-in. The full checklist for Microsoft 365 emergency access accounts.
Three overlapping enforcement systems and no central report make MFA coverage in Microsoft 365 genuinely hard to prove. Here is what insurers will eventually demand and how to produce it.
Compromise is the opening move; persistence is the game. The MFA methods, device joins, app consents, and inbox rules attackers plant in Microsoft 365, with the CIS-mapped settings that block each.
Passkeys stop phishing, not stolen sessions. A real $530K wire fraud shows how pass-the-cookie walks past FIDO2, and the layered Microsoft 365 controls that actually close the gap.
Copilot Studio agents and Team Copilot headline May 2024, alongside mandatory MFA for Azure, external authentication methods in Entra, macOS Platform SSO, and a twelve-feature Teams batch.
SMS codes, push notifications, and passkeys all count as MFA, but they do not stop the same attacks. Here is the strength hierarchy, what defeats each tier, and the upgrade path to phishing-resistant.
