Topic
Business Standard saved one firm $200 a month until a token-theft phish cost them $18,000. The MSP playbook for the Standard to Premium renewal conversation: outcomes, pillars, and objection answers.
Adversary-in-the-middle phishing steals session tokens after a successful MFA prompt. Here is how to deploy MFA in 2026 so the stolen phish is worthless.
Microsoft's Global Secure Access puts Entra ID in front of internet traffic, on-prem apps, and file shares. Here is what it stops in practice and what it costs.
Five Entra ID settings included in Business Premium close off reconnaissance, password spray, rogue app consent, and token theft. Here is where each one lives and how to enable it.
Token protection reaches Entra ID P1, Defender gains mail-bombing detection, the Conditional Access Optimization Agent hits GA, and Intune ships LAPS for macOS.
Entra flags risky users by default, but nobody gets told and nothing happens without P2. How to route risk detections to your PSA and the one policy that prevents most compromises.
Token theft via AiTM phishing hit 51% of webinar respondents in the past year. Five layered controls, from Defender tuning to attack disruption, break the kill chain at each stage.
Six Conditional Access policies can stop token theft before it starts. Each blocks a different part of the attack, and each has a gap. Here is the full comparison with exact settings.
Entra's token protection session control sounds like the end of token replay. In testing, stolen tokens still replay in the browser. Here is exactly what the preview covers, as of May 2025.
A stolen session token becomes a BEC campaign fast. This runbook walks the full cleanup, confirm, scope, evict, recover, with the exact portals, KQL queries, and PowerShell for each step.
A malicious OAuth app keeps mailbox access after every password reset. How attackers plant them in Microsoft 365, plus the consent lockdown and hunting runbook.
Microsoft blocks 7,000 password attacks per second, yet only 41% of Entra sign-ins use MFA. The data behind the passwordless push, and an honest look at what the passkey experience is like today.
