Prioritizing Defense in an AI-Accelerated Threat Landscape – Cloud Diary
CLOUD DIARY
AZURE · MICROSOFT 365 · SECURITY
● REAL CASES · REAL SETTINGS
Prioritizing defense in an AI-accelerated threat landscape
Five real attacks on Microsoft 365 and Azure from the last two years, and the exact settings in your tenant that would have stopped them.
48hrs
is about how long an exposed cloud asset lasts before it gets hit
54%
of people clicked AI-written phishing. Normal phishing got 12%
97%
of identity attacks still start with a stolen or guessed password
99%
of identity attacks get blocked once MFA is turned on
source · Microsoft Digital Defense Report
#Microsoft365#Azure#EntraID#ConditionalAccess
✍️ Anuradha · real incidents, the settings that stop them, and queries you can run today
what changed
The attacks are old. The speed is new.
When I went through the incidents in this post, I expected to find clever new techniques. I mostly didn't. A forgotten account with no MFA. A phishing page that copies the session. A fake meeting invite. A phone call to the help desk. A sync server nobody was watching.
What AI changed is the cost. A good phishing email used to take time and good English. Now it takes seconds, in any language. Scanning for weak spots used to take patience. Now it runs on its own, and an exposed cloud asset can be hit within about two days.
So the goal isn't to chase every new AI threat. It's to close the same few doors faster than the attackers can find them.
the good news
Almost every fix in this post is a setting you already have a license for in Entra ID, Defender or Azure.
The hard part is applying it to every account and every subscription, with no exceptions left behind.
how an attack moves
Five steps of an attack, and what stops each one
↔ scroll sideways on mobile · red shows the attacker, green shows the control that blocks that step
Keep this picture in mind for the cases below. Each one broke in at a different step, and each one would have been stopped by the green box under it.
real incidents
Five real attacks, and how to block them in your tenant
For each one: what actually happened, where AI makes it worse, and the settings to change. The grey path under each step shows where to find it.
01IdentityJanuary 2024
A forgotten test account opened senior leaders' inboxes
Midnight Blizzard vs Microsoft
What happened
Russian state hackers ran a slow password spray from residential IP addresses, so the traffic looked like normal home users.
They found an old, non-production test account with no MFA. From there they took over a legacy test OAuth app that still had high permissions in the corporate tenant.
They used it to grant themselves full mailbox access in Exchange Online and read email from senior leadership.
Where AI makes it worse
Finding forgotten accounts and guessing weak passwords is exactly the kind of boring, repetitive work that AI tools now do at scale. Every old test tenant, lab account and unused app is on someone's list.
Protect your tenant
1
MFA for every account, including test and lab tenants. Only your two break-glass accounts get an exclusion.
Entra admin center → Conditional Access → Policies
2
Stop users from consenting to apps on their own. Turn on the admin consent workflow so requests come to you.
Entra → Enterprise apps → Consent and permissions
3
Review apps that have application permissions to mail, files or the directory. Remove the ones nobody owns.
Phishing kits that steal the session, not the password
Tycoon 2FA, plus an AI-written phishing campaign
What happened
Tycoon 2FA sat between the user and the real Microsoft 365 sign-in page. The user typed the password and approved MFA as normal. The kit copied the session cookie and the attacker reused it from their own machine.
Microsoft says it was linked to compromised accounts at nearly 100,000 organizations. It was rented on Telegram for about $120. Microsoft and Europol took it down in March 2026, and reports say it came back soon after.
In August 2025 Microsoft also caught a phishing campaign whose hidden code looked like it was written by an AI model. It was buried inside an SVG file that pretended to be a PDF.
Where AI makes it worse
AI writes better lures in any language and generates new code for each campaign, so content filters have less to match on. Push approvals and SMS codes don't help here at all, because the user really did approve the sign-in.
Protect your tenant
1
Require phishing-resistant MFA (passkeys, Windows Hello, FIDO2 keys). Start with admins and finance, then everyone.
Conditional Access → Grant → Require authentication strength
2
Require a compliant or hybrid-joined device for Microsoft 365. A stolen cookie on the attacker's laptop then fails.
Conditional Access → Grant → Require compliant device
3
Add token protection for Exchange, SharePoint and Teams on Windows. It is GA for native apps and binds the token to the device.
03Phishing · Device codeAugust 2024 – February 2025
A fake Teams invite that asked for a code
Storm-2372
What happened
The attackers first built trust over WhatsApp, Signal or Teams while pretending to be someone important. Then they sent a Teams meeting invite with a code in it.
The victim typed the code into a real Microsoft sign-in page. That is the device code flow, made for smart TVs and meeting room devices. It handed the attacker a valid token for the victim's mailbox, with no password needed.
Later they registered devices in Entra ID to keep their access. Targets included government, defense, IT, telecom, health and energy organizations, including in the Middle East.
Where AI makes it worse
Building a believable fake identity and keeping a conversation going for days used to take real effort. AI makes it cheap to run many of these conversations at once.
Protect your tenant
1
Block the device code flow with Conditional Access. Run it in report-only mode first and exclude only the meeting room devices that really need it.
One phone call to the help desk cost about £300 million
Marks & Spencer (linked to Scattered Spider)
What happened
An attacker pretended to be an M&S employee and asked the outsourced IT help desk to reset a password. The help desk did it.
A week later ransomware hit the company's VMware hosts. Online orders stopped for 46 days and customer data was stolen.
M&S estimated around £300m off its operating profit. No exploit was needed for the first step. Just a convincing call.
Where AI makes it worse
Voice cloning tools can copy someone's voice from a short clip, and the answers to the usual security questions are often on LinkedIn. A help desk that checks identity by phone alone is now an easy target.
Protect your tenant
1
Don't reset passwords or MFA based on a phone call alone. Verify identity first, for example with Entra Verified ID and Face Check, then issue a Temporary Access Pass.
The group started on-premises and got domain admin. They then reached the Entra Connect sync server and used it to look into the cloud tenant.
They found a synced, non-human account with Global Admin and no MFA. They reset its password on-premises, it synced to the cloud, and now they owned the tenant.
They added their own tenant as a trusted federated domain as a backdoor, took control of Azure resources, copied the data out, and then mass-deleted resources and backups so the victim couldn't recover. The ransom demand came over Teams.
Where AI makes it worse
Attackers move from on-premises to cloud faster when they can script the discovery. The weak spots are the same every time: sync servers, admin accounts without MFA, and backups that an admin can delete.
Protect your tenant
1
Treat the Entra Connect server like a domain controller. Keep it patched, update to 2.5.3.0 or later, and turn on TPM.
Entra Connect → upgrade · server hardening
2
Never sync admin accounts from on-premises. Admins should be cloud-only, with phishing-resistant MFA.
Entra → Roles & admins → review role members
3
Alert on 'elevate access' in Azure. It is rare, and it gives the user control over every subscription.
You can't fix everything at once. This is the order I'd use, based on how much each step blocks from the cases above.
P0
FIRST 30 DAYS
Close the front door
Goes straight after cases 01, 02 and 03. Mostly Conditional Access settings and cleanup.
🔑 MFA everywhere, stronger for admins
MFA for every account with no forgotten exceptions. Phishing-resistant authentication strength for admins, finance and executives.
🚪 Block legacy auth and device code
Two Conditional Access policies. Use report-only mode for a week, then turn them on.
🧹 Clean up forgotten accounts and apps
Test accounts, old tenants, apps with mail permissions. Turn off user consent.
🧯 Lock your backups
Immutable vault, always-on soft delete and multi-user authorization. Then test one restore.
P1
BY 60 DAYS
Limit the damage
Covers cases 04 and 05, where the attacker already got one foot inside.
⏱️ PIM for every admin role
No standing Global Admin. Approval and a time limit for the rest.
☁️ Cloud-only admins
Stop syncing privileged accounts from on-premises. Harden the Entra Connect server.
📞 A help desk process that can't be talked around
Verified ID check, then a Temporary Access Pass. No resets based on a phone call alone.
💻 Device-bound sessions
Compliant device requirement and token protection, so a stolen cookie is useless elsewhere.
P2
BY 90 DAYS
See it when it happens
Assume something gets through. These make sure you notice in minutes, not weeks.
📡 Send Entra logs to Sentinel
Sign-in and audit logs in a workspace, so the queries below can run as alerts.
🚨 Alert on the rare stuff
New MFA methods on admins, elevate access, new app consents, mass deletions in Azure.
🛡️ Defender for Cloud posture
Find public storage, open management ports and attack paths before someone else does.
🧪 Practise the response
Time how long it takes to revoke a user's sessions and restore one server.
effort against reward
Start with the top-left corner
positions give a rough idea, not exact measurements
The controls that cut the most risk are also the cheapest and the least exciting. Most of the top-left corner is a few Conditional Access policies and some cleanup.
check your own tenant
Seven queries to run today
Each one maps back to a case above. The first five need Entra sign-in and audit logs sent to a Log Analytics workspace or Sentinel. The last two run in Azure Resource Graph Explorer with no setup.
01Who still signs in with legacy protocols?Log Analytics · SigninLogs›
Anything listed here skips Conditional Access. Fix or block each one before you enforce the block tenant-wide.
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| where ClientAppUsed !in ("Browser", "Mobile Apps and Desktop clients")
| summarize SignIns = count(), LastSeen = max(TimeGenerated)
by UserPrincipalName, ClientAppUsed, AppDisplayName
| order by SignIns desc
02Who used the device code flow?Log Analytics · SigninLogs›
Run this before you block device code flow. Sign-ins from unmanaged devices are the ones to look at first.
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| where AuthenticationProtocol == "deviceCode"
| extend Managed = isnotempty(tostring(DeviceDetail.deviceId))
| project TimeGenerated, UserPrincipalName, AppDisplayName,
IPAddress, Location, Managed
| order by TimeGenerated desc
Look for apps you don't recognise, or apps that asked for mail or file access.
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Consent to application"
| extend User = tostring(InitiatedBy.user.userPrincipalName),
App = tostring(TargetResources[0].displayName)
| project TimeGenerated, User, App, Result
| order by TimeGenerated desc
04Who added a new MFA method?Log Analytics · AuditLogs›
After a help desk reset or a session theft, attackers usually register their own MFA method. Check these against your admin list.
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("User registered security info",
"User registered all required security info")
| extend User = tostring(TargetResources[0].userPrincipalName),
IP = tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, User, OperationName, IP, Result
| order by TimeGenerated desc
05Did anyone use 'elevate access' in Azure?Log Analytics · AuditLogs›
This gives User Access Administrator on every subscription. In most tenants it should almost never show up.
AuditLogs
| where TimeGenerated > ago(90d)
| where Category == "AzureRBACRoleManagementElevateAccess"
| extend Actor = tostring(InitiatedBy.user.userPrincipalName),
IP = tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, OperationName, Actor, IP, Result
06Can your backups be deleted?Azure Resource Graph›
You want immutability 'Locked' and soft delete 'AlwaysON'. Anything else can be wiped by a stolen admin account.
resources
| where type =~ "microsoft.recoveryservices/vaults"
| extend Immutability = tostring(properties.securitySettings.immutabilitySettings.state),
SoftDelete = tostring(properties.securitySettings.softDeleteSettings.softDeleteState)
| project name, resourceGroup, subscriptionId, Immutability, SoftDelete
| order by Immutability asc
07Which storage accounts are open to the internet?Azure Resource Graph›
Exposed storage gets found within days. Check anything that allows public blob access or public network access.
resources
| where type =~ "microsoft.storage/storageaccounts"
| extend PublicBlob = tobool(properties.allowBlobPublicAccess),
PublicNetwork = tostring(properties.publicNetworkAccess)
| where PublicBlob == true or PublicNetwork != "Disabled"
| project name, resourceGroup, subscriptionId, PublicBlob, PublicNetwork
Tip: once a query gives you useful results, save it as a Sentinel analytics rule so it runs on its own.
a two-minute check
How does your tenant look?
Only tick what is fully done today, not what's planned.
Your result shows up here…
if you only do one thing
Find every account that can still sign in without MFA, especially admin accounts, synced service accounts and old test accounts. That one gap was the way in for cases 01 and 05. The authentication methods report in Entra shows it in a few minutes.
Case details come from Microsoft Threat Intelligence reports and public reporting linked under each case. Diagrams were drawn for this post with the official Azure icon set.
