Most organizations assume that if something serious were happening in their Microsoft 365 tenant, they’d know about it. The uncomfortable reality is that the threats doing the most damage rarely announce themselves. A password spray looks like a handful of failed logins. A compromised mailbox looks like a user who set up a forwarding rule. A data theft looks like someone downloading files for a project.
That’s the gap the Modern SecOps Envisioning Workshop is built to close. Over several weeks, TrustedTech deploys Microsoft Sentinel and the unified SecOps platform against your live environment, collects real signals from identity, email, and data sources, and shows you what’s already there.
Microsoft’s workshop guidance identifies seven threat types that are most likely to surface during the engagement. Here’s what each one is, what it looks like when Microsoft’s tools catch it, and what we typically recommend to shut it down.
Why these seven threats keep showing up
Before getting into the list, it helps to understand the pattern. Six of the seven threats below are either identity attacks or consequences of an identity being compromised. Microsoft’s own guidance notes that most breaches start with a compromised identity, often through a successful phishing email.
This is why the workshop integrates signals from Microsoft Entra ID, Microsoft 365, and Defender directly into Sentinel from the very beginning. Although each of these alerts on its own might appear harmless, when they are correlated in a single incident queue, they tell a story: a phishing email, then a risky sign-in, then a new inbox rule, and finally a mass file download. It is by seeing that sequence that you can tell the difference between detecting an attack as it is happening and discovering it in a breach report.
1. Leaked credentials
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
When attackers obtain valid passwords, they almost never retain them for themselves; instead, the credentials are uploaded to paste sites, sold on dark web markets, and traded in large quantities. The credentials leakage service from Microsoft keeps an eye on these sources and collaborates with researchers, law enforcement, and its own security teams to gather exposed username-password combinations. If such a combination matches one of your users' currently valid credentials, Entra ID Protection triggers a leaked credentials risk detection.
Why it matters: A leaked credential means an attacker may not need to phish or guess anything. They already have a working password. If that account doesn’t require multifactor authentication, they can simply log in.
What we recommend:
- Start by enforcing multifactor authentication (MFA) on all users, beginning with those who have privileged accounts.
- Apply Conditional Access policies in order to demand more rigorous verification when risk is identified.
- Make it possible for users to reset their own passwords so that they can automatically deal with a leaked credential.
- Turn on Microsoft Entra Password Protection in order to stop the use of weak and commonly used passwords.
- Switch to passwordless sign-in using Windows Hello for Business.
When preparing your business case on the subject of multi-factor authentication, you may find our analysis of the costs and return on investment of such authentication to be a good place to start.
2. Multiple failed login attempts (password spray and brute force)
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
This is the threat behind one of the most common concerns we hear: “attacks disguised as failed logins.” There are two main variants.
A password spray attack involves testing a small number of frequently used passwords on a large number of accounts. For any individual user, it appears as just one separate failed login, which is the reason it goes unnoticed by most conventional monitoring systems. The attackers do not need many successful logins; even a small number of successful logins out of every thousand accounts is enough for them to gain access so that they can read email, collect contact details, and then carry out more phishing from a trusted address.
A brute force attack does the opposite. It hammers a small set of high-value accounts, such as executives or IT admins, with many password guesses.
Why it matters: Password spray is designed to stay below alert thresholds. Without behavioral analytics looking across the whole tenant, you won’t see it until an account is already compromised.
What we recommend:
- Configure Entra ID Protection sign-in risk and user risk policies to detect and respond automatically
- Enable Entra smart lockout to block attackers while letting legitimate users keep working.
- Enforce MFA and Conditional Access
- Reduce standing admin access with Microsoft Entra Privileged Identity Management (PIM)
- Deploy Microsoft Defender for Identity if you still run on-premises Active Directory.
3. Suspicious sign-in activity
Category: Identity
Detected by: Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps
This category covers a family of risky sign-in detections, including:
- Sign-ins from anonymous IP addresses or Tor exit nodes
- Impossible travel (a user signing in from two locations too far apart to travel between in the time elapsed)
- Activity from an infrequent or unfamiliar country
- Sign-ins with unfamiliar properties for that user
Microsoft's tools establish a baseline of normal behaviour for each user and for your organization over a initial learning phase, after which each session is evaluated against that baseline using more than 30 risk indicators and an alert is generated if something doesn't fit.
Why it matters: Individually, a VPN login or a sign-in from an airport can be innocent. That’s exactly why security teams tune these alerts out. In the workshop, Sentinel correlates them with what happened next, which is how you tell a traveling sales rep from an attacker using stolen credentials.
Our recommendation is to apply the same controls as mentioned above, namely risk-based policies, MFA, Conditional Access, PIM, and password protection, along with setting up a monitoring process so that someone actually looks at the risky users rather than having the alerts accumulate.
4. Phishing attempts
Category: Email, Identity
Detected by: Microsoft Defender for Office 365, Exchange Online Protection
Phishing is still the most frequently used method by attackers for obtaining the credentials that enable threats 1 to 3. The two traditional types:
- The links used for credential harvesting direct users to a fake sign-in page which takes note of the user's username and password as soon as they enter them.
- Malicious attachments: a file, typically a PDF, requests the user to 'sign in' in order to view the document, once again sending the credentials to the attacker.
The importance lies in the fact that a single successful phish can provide an attacker with a valid identity, and all the subsequent actions on this list then become possible.
What we recommend:
- Deploy Defender for Office 365 anti-phishing policies to catch identity fraud attacks.
- Enable Safe Links and Safe Attachments
- Configure SPF, DKIM, and DMARC for every email domain so receiving systems can verify your mail is really from you.
- Turn on Defender XDR alert policies for suspicious email activity.
- Run attack simulations and security awareness training so users can spot and report phishing.
For a deeper look at the email layer, see our guide to Microsoft Defender for Office 365 phishing protection.
5. Malware
Category: Email, Data
Detected by: Microsoft Defender for Office 365, Exchange Online Protection, Microsoft Defender for Cloud Apps
Microsoft splits malware into two groups, and the distinction matters for your defenses:
- Classic methods, such as matching file hashes and checking reputation signals, can be used to identify known malware, and Exchange Online Protection deals with this.
- This malware has not been seen before and cannot be identified by using a signature; instead, Defender for Office 365 detects it by running the suspicious files in a sandbox and using heuristics and machine learning.
Why it matters: If your email protection stops at signature-based scanning, unknown malware gets through. The workshop shows you how much of what’s hitting your inboxes falls into that second category.
What we recommend:
- Enable Safe Attachments and Safe Links in Defender for Office 365
- Review and tighten Exchange Online Protection anti-malware policies.
- Use Defender for Cloud Apps malware policies to scan SharePoint Online, OneDrive, Teams, and supported third-party apps such as Box and Dropbox.
- Turn on Defender for Cloud Apps ransomware activity policies.
6. Suspicious mailbox activity
Category: Email
Detected by: Microsoft Defender for Cloud Apps
This is the quiet compromise. Once an attacker has access to a mailbox, a few small changes let them stay in control without the user noticing:
- Suspicious inbox forwarding sends a copy of every incoming email to an external address.
- Inbox manipulation rules move or delete messages, often to hide replies from the attacker’s own phishing or fraud attempts.
- Suspicious email deletion removes evidence.
From there, attackers can pull sensitive information from the mailbox, browse the global address list to plan the next attack, and send spear-phishing emails from a trusted internal account.
Why it matters: These changes often set the stage for business email compromise (BEC) and invoice fraud. They also confirm that an account is already compromised, even if no other alert has fired.
What we recommend:
- Deploy Defender for Cloud Apps anomaly detection policies for suspicious mailbox activity, with automated response.
- Enable Microsoft 365 alert policies for suspicious mailbox activity.
- Block automatic external forwarding by default and allow it only by exception.
7. Unusual user activity
Category: Email, Data
Detected by: Microsoft Defender for Cloud Apps, Microsoft 365 alert policies
The final threat type is what an attacker does with a compromised account once inside:
- Unusual multiple file downloads (data exfiltration)
- Unusual file sharing (data leakage)
- Unusual file deletion (destruction or ransomware staging)
- Unusual impersonation activity (lateral movement)
- Unusual administrative activity (persistence and privilege escalation)
When the account that has been compromised is that of an administrator, the extent of the damage increases. Generally, attackers will attempt to establish persistence so that resetting one password will not eliminate them.
The importance lies in the fact that at this stage the security incident turns into a data breach; the sooner it is detected the less will leave the premises.
What we recommend:
- Set up Defender for Cloud Apps anomaly detection policies to include automated responses, for example by suspending the user.
- Set up Microsoft 365 alert policies to address suspicious user activity.
- Detect pairs by having a clear incident response procedure so that alerts are dealt with rather than merely being logged.
What happens after the threats are found
The value of identifying threats is only half the story; the workshop concludes with a results presentation in which each threat found in your environment is mapped to:
- The technical mitigation (for example, Safe Links for phishing or risk-based Conditional Access for password spray)
- The next step that is recommended could be a policy change which your team can implement this week, or it might involve a wider rollout of the Defender for Office 365 or Entra ID P2 features, or it could be a production deployment of Microsoft Sentinel to either replace or supplement your existing SIEM.
A few organizations have the necessary team in place to act on the findings by themselves, while in other cases the organization does not operate a security operations centre and in such instances the appropriate next step is to have regular oversight and incident response. TrustedTech also offers the option of carrying out remote monitoring and threat hunting during the workshop and provides managed detection and response afterwards.
Frequently Asked Questions
Q. What kinds of threats does the Modern SecOps Envisioning Workshop identify?
A. The guidance from Microsoft lists seven types of threats that are most likely to be encountered: leaked credentials, multiple failed login attempts (which include password spraying and brute force), suspicious sign-in activity, phishing, malware, suspicious mailbox activity, and unusual user activity.
Q. What constitutes a password spray attack?
A. A password spray attack involves trying a number of common passwords on many accounts simultaneously, since each account records only a single failed login attempt, the attack is usually able to avoid triggering standard alerts. However, Microsoft Entra ID Protection and Defender for Cloud Apps can identify the pattern throughout your tenant.
Q. What is an impossible travel alert?
A. A travel alert that is impossible to be true is triggered when the same user logs in from two places that are too far apart to have been reached by travel within the time that has passed; this is a typical indication that a stolen credential is being used from a different country.
Q. How does Microsoft detect leaked credentials?
A. Microsoft monitors public and dark web sources and works with researchers and law enforcement to collect exposed username and password pairs. Entra ID Protection checks them against your users’ current credentials and raises a risk detection when there’s a match.
Q. Do we need Microsoft 365 E5 to find these threats?
A. Several detections rely on capabilities included in Microsoft 365 E5 or security add-ons, such as Entra ID Protection and Defender for Cloud Apps. The workshop uses trial licensing so you can see the results before making a licensing decision. Talk to your TrustedTech account team about which licenses fit your environment.
See what’s hiding in your environment.
Every one of these seven threats is easier to stop when you can see it, and harder to see when your security tools work in silos. The Modern SecOps Envisioning Workshop gives you a few weeks of live visibility across identity, email, and data, a findings report built from your own environment, and a clear plan for what to fix first.
Want to know which of these threats are active in your tenant right now? Register for the Modern SecOps Envisioning Workshop and talk with TrustedTech’s security team about scoping it for your organization.
