Topic
Security of Microsoft 365 and Entra ID tenants, including mailbox rules, OAuth grants and session revocation.
Veeam made Intelligent ResOps generally available for Microsoft 365, with file-by-file undo of AI agent changes. Veeam's pitch is that agents acting at machine speed make security and recovery one job.
Reality
Proofpoint will ship four Microsoft 365 security features to MSP partners in the fourth quarter, led by a tenant permission-risk map. Its argument is that oversharing and stale guest accounts need cleaning up before customers switch on AI tools, so the partner's first job is a cleanup.
Reality
Overe, a three-year-old Microsoft 365 security vendor selling through MSPs, has named former Sophos CSO Simon Reed as a strategic advisor. The advisory seat puts a senior name in front of service providers while committing the company to far less than an executive hire would.
Reality
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
Arctic Wolf says the cluster it tracks as PREY-0058 deploys no malware at all. A call from fake IT leads to a proxied login page, and the stolen session token comes back from inside the victim's own ASN.
Perspective Coverage
3 publishersReality
Proofpoint says an unknown actor sprayed over 5,700 M365 accounts in Chile and breached only seven, all dormant service accounts at one retailer. Employee logins held, and those seven unused accounts still gave the attacker mail, Teams chats, OneDrive files and, in one case, the Azure portal.
Reality
Microsoft's guidance on illicit consent grants says password resets and MFA do not touch the access, and it sends admins to the Purview audit log, where the entry can take up to 24 hours to appear.
Reality
The FBI says a subscription kit sold on Telegram harvests Microsoft 365 OAuth tokens through device code lures. The mitigation it recommends is a tenant-wide block, and somebody has to decide the exceptions.
Reality
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality