Ask a security team what they are worried about, and you will hear about ransomware, nation-state actors, and zero-days. Then turn on telemetry in their Microsoft 365 tenant and see what is actually there. The findings are almost never exotic. They are leaked passwords on websites, inbox-forwarding rules that nobody created on purpose, and sign-ins from countries where the company has no staff.
That gap matters because it changes where the money should go. Organizations budget against the threats they read about and get compromised by the threats they never looked at. In most Microsoft 365 environments, the detection capability for the second category is already licensed and already sitting there unconfigured.
This post walks through the seven threat categories that surface most consistently when you properly instrument a Microsoft 365 and Azure environment: what each one is, which Microsoft tool detects it, and what finding it actually tells you about your posture. These are the same categories that structure a Threat Protection Envisioning Workshop, so if you are weighing whether that kind of engagement is worth your team’s time, this is a reasonable preview of what it would turn up.
Why these seven and not the headline threats
There is a reason the list below skews toward credentials and mailboxes rather than malware and exploits.
Most breaches do not start with a clever exploit. They start with a valid login. An attacker with valid credentials does not need to defeat your endpoint protection because, from the platform’s point of view, they are an employee doing employee things. The detections that matter are therefore behavioral: this account signed in from an impossible location, this mailbox suddenly forwards everything offsite, this user downloaded four thousand files at 2am.
Those signals are quiet. They do not page anyone. They accumulate in portals that nobody has assigned an owner to. Which is precisely why an assessment finds them, and a normal Tuesday does not.
The seven threat categories
Note that these are grouped by category rather than by frequency, and a single compromised account will often light up three or four of them at once.
1. Leaked credentials
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
Microsoft runs a leaked credentials service that collects username and password pairs surfacing on public sites, paste sites, and dark web markets, and sources them through security researchers, law enforcement, and its own threat intelligence teams. Those pairs get checked against the live credentials in your directory. A match triggers a leaked-credentials risk detection, indicating that one of your users is currently using a publicly known password.
This finding is the least ambiguous one on the list. There is no false positive interpretation and no “we accept that risk” conversation to have. The mitigation stack is well established: multifactor authentication, Conditional Access, self-service password reset for automatic remediation, and Entra Password Protection to stop the weak passwords from being set in the first place. If you are still federating through AD FS, moving to password hash synchronization is part of this conversation too.
2. Malware detection
Category: Email, Data
Detected by: Exchange Online Protection, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps
There are two types of malware: known (previously identified) and unknown (threats that have never been cataloged).
Known malware has been analyzed and documented by Microsoft or other threat providers. Microsoft blocks roughly 4.5 million net new malware files every day, according to its 2025 Digital Defense Report. Every Microsoft 365 tenant with Exchange Online has that layer.
Conversely, unknown malware is a new threat that has not been seen before and cannot be matched against a signature, so catching it requires detonation, heuristics, and machine learning models. That is what Microsoft Defender for Office 365 adds through Safe Attachments and Safe Links, and it is why the Plan 1 versus Plan 2 decision is worth considering rather than defaulting.
An assessment that finds only known malware tells you Exchange Online Protection is doing its job. When an assessment finds unknown malware getting through, that tells you your email security stops at signatures, which in 2026 is not a defensible position.
3. Multiple failed login attempts
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
Two different attacks produce this signal, and each calls for a different response.
Password spray attacks try a small set of common passwords (e.g., “Welcome123!”) against a large number of accounts, often enumerated across an organization using predictable naming patterns like first-initial-last-name. The reason it evades detection is that from inside any single tenant, a spray looks like an isolated failed login by a user who fat-fingered their password.
Brute force is narrow and deep. Many attempts against a small set of accounts, typically chosen for having elevated access. Executives and infrastructure admins.
Entra smart lockout is the practical answer to both, because it locks out the attacker without locking out the real user. Layer Conditional Access on top and use Privileged Identity Management to reduce standing administrator access, which makes the brute-force targets valuable in the first place.
4. Phishing attempts
Category: Email, Identity
Detected by: Microsoft Defender for Office 365, Exchange Online Protection
Phishing remains the most prevalent method by which an organization can become vulnerable. This time-tested approach has not fundamentally changed: a legitimate-looking message that leads to a credential-harvesting page, or an attachment that asks the recipient to sign in again to open it.
What has changed is the delivery method. Attackers have adapted to the fact that email security has gotten good, so phishing can now take the form of a text message or a phone call when email fails.
The technical mitigations are anti-phishing policies for impersonation protection, Safe Attachments and Safe Links, and correctly configured SPF, DKIM, and DMARC records for every sending domain. The DNS component is skipped more often than you might expect, and it is the cheapest item on the list.
5. Suspicious sign-in activity
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
This category tends to generate the most useful findings because it covers a wide range of unusual sign-in behavior. That might mean a login from a Tor exit node, an anonymous VPN, or a country where your organization has no employees. It also includes “impossible travel” events, for example, when the same user appears to sign in from Seattle and London within an hour.
What makes these detections effective is that they are not based on a fixed checklist. Entra ID Protection and Defender for Cloud Apps spend time learning what is normal for each user. After that learning period, they compare every new sign-in against that individual’s typical behavior using dozens of risk signals. If someone’s activity suddenly falls outside their normal pattern, the system raises the risk score. Without that behavioral baseline, many of these anomalies would look like ordinary sign-ins.
If you only fix one category, fix this one. Identity is where cloud environments actually break down, a point we have made at length elsewhere.
6. Suspicious mailbox activities
Category: Email
Detected by: Microsoft Defender for Cloud Apps
Mailbox changes are one of the clearest signs that an attacker may already control an account. Common examples include newly created forwarding rules, rules that move security notifications out of sight, and unusual email-deletion activity.
The reason these changes matter is practical. An attacker who forwards incoming mail can continue collecting information even after the original password is changed. A rule that hides password-reset notices or security alerts may delay discovery, while deleted messages can remove evidence of what happened.
The mailbox also gives the attacker useful context. It may contain sensitive documents, internal conversations, contact information, and examples of how employees communicate. That information can then be used to target another employee with a much more convincing phishing message.
Defender for Cloud Apps and Microsoft 365 alert policies can identify many of these behaviors. These alerts should be investigated quickly, although the presence of a forwarding rule alone does not always prove compromise; some users and administrators create them for legitimate reasons.
7. Unusual activities by the user
Category: Email, Data
Detected by: Microsoft Defender for Cloud Apps, Microsoft 365 alert policies
The final category covers what happens after the attacker is established and behaving like an insider: unusual volumes of file downloads, unusual file sharing, mass deletion, impersonation activity, and unusual administrative actions.
These detections rely on the same user and entity behavior baselines used to identify unusual sign-in activity. That means the work required to establish the baseline supports more than one type of detection. It also means the alerts become more useful only after the platform has had enough time to learn what normal behavior looks like for each user.
Unusual administrative activity is often where a routine account compromise turns into something much more serious. If the attacker gains access to a privileged account, they are no longer limited to the data that the user can reach. They can create new administrators, modify permissions, disable security controls, or add another trusted way back into the tenant. Once that happens, the response typically expands from cleaning up a single account to investigating the entire Microsoft 365 environment.
Identity is the common thread
Looking across the seven categories, five are identity-related or can directly result in an identity compromise. The remaining two involve malware or data movement, but those activities often occur after an attacker has already gained access to a user account.
Identity monitoring should not sit off to the side as a separate security function. Endpoint protection can stop malware and suspicious device activity, but it will not tell you when a valid account is being used from an unusual location or when privileges change unexpectedly. Without that visibility, an attacker may already be moving through the environment before the endpoint tools have anything obvious to detect.
You probably already own most of the detection
Here is the part that surprises people, and it is a licensing question rather than a security question.
Exchange Online Protection is in every tenant. Defender for Office 365 Plan 1 is included in Microsoft 365 Business Premium, and Plan 2 in E5. Full risk detection and investigation in Entra ID Protection requires Entra ID P2, which is included in Microsoft 365 E5 and EMS E5. Defender for Cloud Apps is included in E5 and available standalone.
For most E5 customers, six of the seven categories can already be detected using their licenses. The usual problem is operational: the policies were never turned on, the platform never had time to build a baseline, or no one was assigned to review the alerts. Assessments often uncover security features that have been included in the subscription for months or years but have never been used.
Find out what is actually in your environment
Every threat in this post is detectable. The question is whether anyone is looking.
The Threat Protection Envisioning Workshop is a structured engagement that scans your Microsoft 365 and Azure environment across email, identity, endpoints, and data, then maps the findings to specific recommendations you can act on. It is not a slide deck about hypothetical risk. It is a report on your tenant.
What the engagement covers:
- Review of your security goals and objectives
- Identification of real threats and vulnerabilities in your environment, not generic industry examples
- Alignment of the identified risks with targeted solution recommendations
- A joint plan and agreed next steps
Choose your modules. Delivery is modular. You select three of the following six, based on where your exposure and your priorities actually are:
- Unified SecOps Platform
- Email Protection
- Endpoint and Cloud Apps Protection
- Identity Protection
- Server Protection
- Microsoft Security Copilot demonstration
Why TrustedTech. When it comes to security, you want a partner who has done this before. TrustedTech holds the Microsoft Solutions Partner for Security designation, which recognizes its demonstrated capability to deliver advanced security solutions across Microsoft 365 and Azure. Our practice spans Microsoft Entra ID, Azure, Microsoft 365, Purview, Defender XDR, Sentinel, Intune, and on-premises Microsoft infrastructure, which means the recommendations you get account for what you already license and how your environment is actually built.
Schedule a Threat Protection Envisioning Workshop and find out what your telemetry has been recording while nobody was reading it.
