08/27/2026
Identity attacks rose 32% in the first half of 2025, and 97% of them were password attacks, per the 2025 Microsoft Digital Defense Report. Almost every victim tenant owned Conditional Access. Most never finished deploying it.
Three patterns worth stealing.
Pattern one, the baseline. MFA for all users on all apps, legacy authentication blocked outright, compliant device required for sensitive data. Legacy auth protocols like IMAP and SMTP AUTH cannot enforce MFA, which is exactly why password spray targets them. One policy closes the class.
Pattern two, privileged access. Target Entra directory roles, not named users, and apply an authentication strength that only accepts phishing-resistant methods. FIDO2, Windows Hello for Business, certificate-based auth. Phishing-resistant methods block over 99% of identity attacks, and AiTM kits cannot replay a credential that never leaves the device.
Pattern three, risk-based enforcement. Wire Entra ID Protection signals into Conditional Access. High sign-in risk gets challenged or blocked. High user risk forces a password reset. Token protection binds sessions to the issuing device so stolen cookies die on arrival.
And the five misconfigs that undo all three: exclusion groups that never expire, policies targeting named admins instead of roles, no legacy auth block, break-glass accounts that are unmonitored or missing, and changes shipped without report-only testing.
Quick wins this week:
✅Count your standing Conditional Access exclusions and give each one an expiration
✅Apply phishing-resistant authentication strength to every Entra admin role
✅Move one ID Protection policy from report-only to enforce
Which misconfig have you found in your own tenant?
Shahid Muhammad I Matteo Migliori I Stephen Lazzara I Malissa Salzinger
