Multi-CloudDetection & Response
Detecting Remote Access Without MFA: Sentinel and GuardDuty Detections
Remote access without MFA is a top ransomware entry point. These detections look for single-factor access and the activity that typically follows.
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
Multi-CloudCIO Briefings
CIO Brief: Change Healthcare and the Systemic Risk of One Missing Control
The short version: In February 2024, ransomware shut down Change Healthcare, disrupting pharmacies and medical billing across the US for weeks. The...
Microsoft 365How-To & Hardening
How to Find Forgotten Test Tenants and Over-Privileged OAuth Apps
Midnight Blizzard got into Microsoft through a forgotten test tenant and a legacy OAuth app with production access. Here is how to find similar risks in...
Microsoft 365Detection & Response
Detecting OAuth App Abuse: Defender XDR and Sentinel Hunting Queries
OAuth application abuse lets attackers access mailboxes and data with app-level permissions that bypass user MFA. These detections focus on privilege...
Microsoft 365CIO Briefings
CIO Brief: The Test Environment Nobody Remembered
The short version: In January 2024, Russian state hackers read email of Microsoft's senior leaders. They got in through an old test account that didn't...
Entra ID & IdentityPlatform Changes
Secure Future Initiative and Microsoft-Managed Conditional Access Policies (Nov 2023)
On November 2, 2023, Microsoft announced the Secure Future Initiative (SFI), a company-wide security commitment following a series of high-profile...
Entra ID & IdentityHow-To & Hardening
How to Review and Customize Microsoft-Managed Conditional Access Policies
Microsoft automatically creates Conditional Access policies in many tenants. Here is how to review them, customize them safely and make sure they fit with...
Entra ID & IdentityHow-To & Hardening
Conditional Access Policy Review Checklist
Use this checklist to review your Conditional Access policies.
Entra ID & IdentityCIO Briefings
CIO Brief: Microsoft Is Changing Your Defaults — Here's What to Know
The short version: In November 2023, Microsoft announced a major security push — the Secure Future Initiative — and began automatically adding security...
Microsoft 365How-To & Hardening
How to Prepare SharePoint Permissions Before Turning On Copilot
Copilot surfaces any content a user can access. Before broad rollout, fix the SharePoint and OneDrive permissions that would expose sensitive data. Here is...
Microsoft 365How-To & Hardening
Copilot Readiness Checklist: Permissions, Labels and Pilot Groups
Use this checklist before expanding Microsoft 365 Copilot beyond a pilot.
Microsoft 365CIO Briefings
CIO Brief: Copilot Will Find Everything Your Users Can Access
The short version: Microsoft 365 Copilot, available since late 2023, can find and summarize anything an employee has access to — instantly. In most...
Entra ID & IdentityIncident Teardowns
Okta Support System Breach (Oct 2023): Session Tokens in Uploaded HAR Files
In October 2023, Okta disclosed that an attacker had used stolen credentials to access its customer support case management system and view files uploaded...
Entra ID & IdentityHow-To & Hardening
How to Sanitize Support Uploads and Bind Tokens to Devices
HAR files shared with support teams can contain live session tokens. Token protection and device-bound sessions limit what a stolen token can do. Here is...
Entra ID & IdentityDetection & Response
Detecting Session Token Theft HAR Files: Entra Sign-In Logs and Sentinel KQL
Session tokens taken from HAR files, infostealer logs or phishing proxies are used to access accounts without signing in. Detection focuses on session reuse...
Entra ID & IdentityCIO Briefings
CIO Brief: Your Identity Provider's Breach Is Your Breach
The short version: In 2023, attackers broke into Okta's customer support system and stole login sessions from files customers had uploaded for...
AzureHow-To & Hardening
How to Govern Azure Storage SAS Tokens and Disable Shared Key Access
SAS tokens grant time-limited access to Azure Storage — but poorly scoped tokens can expose entire accounts for years. Here is how to govern them and remove...
AzureDetection & Response
Detecting SAS Token Exposure: Defender for Cloud and Sentinel KQL
Overly permissive or leaked SAS tokens provide direct access to Azure Storage. These detections help find token exposure and misuse.
AzureCIO Briefings
CIO Brief: AI Projects Create New Data Exposure Paths
The short version: In 2023, Microsoft's own AI researchers accidentally exposed 38 terabytes of internal data — including passwords and private messages —...
Entra ID & IdentityHow-To & Hardening
How to Harden Help Desk Identity Verification and Password Resets
The help desk is now a primary target for social engineering. Here is how to harden identity verification and password/MFA resets.
Entra ID & IdentityDetection & Response
Detecting Help Desk Social Engineering: Entra Sign-In Logs and Sentinel KQL
Help desk social engineering usually ends with a password or MFA reset followed by an attacker sign-in. These detections connect the two.
Entra ID & IdentityCIO Briefings
CIO Brief: Social Engineering the Help Desk Is the New Ransomware Entry Point
The short version: In 2023, a phone call to MGM's IT help desk reportedly led to a ransomware attack that shut down casinos and hotels for days and cost...
Microsoft 365Incident Teardowns
Midnight Blizzard Phishes Through Microsoft Teams (Aug 2023): External Chat as an Attack Vector
On August 2, 2023, Microsoft reported that Midnight Blizzard — the Russian state actor also known as APT29 or Nobelium, linked to SolarWinds — was using...
Microsoft 365How-To & Hardening
How to Restrict External Access and Federation in Microsoft Teams
Microsoft Teams external access lets users chat with people in other organizations. Attackers use it for phishing. Here is how to restrict it to what your...