Microsoft 365: attacks, defense & hardening

Microsoft 365 is a cloud-based productivity suite that combines Exchange Online, SharePoint, Teams, OneDrive, and Azure Active Directory into a single tenant architecture. Because Microsoft 365 centralizes identity, email, file storage, and collaboration, it has become a primary target for threat actors. Attackers abuse federated identities, OAuth application consent flows, and delegated permissions to gain persistent access without touching on-premises infrastructure. Business Email Compromise (BEC) operations frequently exploit misconfigured mailbox delegation and transport rules to silently redirect or copy emails. Adversarial access to a single privileged account can expose the entire tenant: Global Administrator roles grant control over licensing, conditional access policies, and all connected SaaS applications. The shared responsibility model means Microsoft secures the platform, but tenant configuration, identity governance, and data access policies remain the customer's responsibility. Understanding the Microsoft 365 attack surface is therefore mandatory for any SOC or Red Team operating in enterprise environments.

Detection in Microsoft 365 relies primarily on the Unified Audit Log (UAL), accessible via the Microsoft Purview compliance portal or the Search-UnifiedAuditLog PowerShell cmdlet. Critical event types to monitor include MailItemsAccessed (OAuth token replay and mailbox access), Add member to role (privilege escalation to Global Admin or Exchange Admin), Set-MailboxPermission and Add-MailboxPermission (delegation abuse), and FileAccessedExtended in SharePoint (mass data staging). Microsoft Sentinel ingests these signals natively via the Microsoft 365 connector and maps them to MITRE ATT&CK techniques such as T1078.004 (Valid Accounts: Cloud Accounts) and T1114.002 (Email Collection: Remote Email Collection). Defender for Cloud Apps provides behavioral baselines and raises alerts on impossible travel, mass download events, and anomalous OAuth consent grants. Azure AD Sign-In logs should be parsed for legacy authentication protocols (BasicAuth, SMTP AUTH) still active on accounts, as these bypass MFA entirely. Correlating UAL events with Azure AD Identity Protection risk detections significantly reduces false-positive rates and accelerates triage.

Red Teams targeting Microsoft 365 tenants typically begin with password spraying against the legacy authentication endpoint (autodiscover, EWS, or IMAP) using tools such as MSOLSpray or TeamFiltration. Once initial access is obtained, adversaries enumerate tenant configuration with AADInternals or ROADtools to map privileged roles, conditional access gaps, and registered OAuth applications. Illicit consent grant attacks register a malicious Azure AD application and trick a user into granting it Mail.Read or Files.ReadWrite.All permissions, establishing persistence without credentials. Adversaries also abuse Primary Refresh Tokens (PRT) on hybrid-joined devices to obtain seamless SSO tokens usable across all M365 services. Hardening priorities include enforcing MFA on all accounts with no exceptions, disabling legacy authentication protocols via Authentication Policies, restricting OAuth application consent to admins only, enabling Continuous Access Evaluation (CAE), and applying the principle of least privilege to all admin roles using Privileged Identity Management (PIM). Regular review of mailbox delegation, transport rules, and external forwarding rules is essential to detect persistence mechanisms established after an initial compromise.