When Attackers Get Past MFA: Identity Threat Detection and Response for Microsoft 365

Third-party enterprise apps with broad access to Microsoft 365 data have become a serious supply chain risk, and AI-driven vulnerability discovery is raising the stakes. Host Nathan Taylor and Senior Director of Security and Compliance at Pax8, Matt Lee, unpack the SkyKick Cloud Backup and the vulnpocalypse behind surging patch volumes. They make the case for asset inventory, enterprise app consent controls, and attack surface reduction as the strongest defenses available to IT leaders.

Even a hardened Microsoft 365 tenant can be compromised through token theft and adversary-in-the-middle phishing. In this episode of Demystifying Microsoft, host Nathan Taylor of the Sourcepass Center of Excellence for Microsoft gives a hands-on demo of Petra Security Identity Threat Detection and Response (ITDR). He walks through a real six-week business email compromise, explains how residential proxies help attackers blend in, and shows how Petra detected and remediated exposure from the SkyKick supply chain attack.

In this episode of Demystifying Microsoft, host Nathan Taylor of the Sourcepass Center of Excellence for Microsoft is joined by Steve Brining, Cybersecurity Evangelist at Acronis, to discuss why backing up your Microsoft 365 data is critical, how retention policies and backups serve different purposes, and the key strategies to protect your Exchange, Teams, OneDrive, and SharePoint data from deletion, corruption, and insider threats.

Business email compromise is accelerating, and threat actors are moving faster than most security teams can monitor. Host Nathan Taylor and Sourcepass Client Success Manager Tracy Harper break down the attack techniques driving the surge, including device code flow phishing and adversary-in-the-middle token theft, and explain how Microsoft 365 tenant hardening and identity threat detection and response (ITDR) close the after-hours gap. They also cover retiring on-premises Active Directory, modernizing legacy SMTP relays, and why Microsoft 365 Copilot Business is the smarter AI investment for organizations under 300 users.

Attackers have become very good at getting past traditional multifactor authentication. SMS codes and voice calls are now regular targets of SIM swapping, social engineering, and session interception. Microsoft is responding by retiring Microsoft-provided SMS and voice MFA in Microsoft Entra ID and making passkeys the default authentication experience across Microsoft 365, Azure, and connected business applications. In this solo episode of Demystifying Microsoft, host Austin Kelly of the Sourcepass Center of Excellence for Microsoft covers the milestones IT leaders need on their calendars, how passkeys use cryptographic, device-bound authentication to remove whole categories of phishing attacks, and how identity threat detection and response (ITDR) adds containment and remediation inside your Microsoft 365 environment, alongside Microsoft’s native controls rather than in place of them.

Business email compromise is now the leading cause of cyber-related financial loss, and the signals most IT teams rely on to catch it no longer hold up. Host Nathan Taylor and Petra Security Co-founder and COO Nathan Ostrowski explain how residential proxies, phishing toolkits, and SEO phishing let attackers log in from your users’ own cities. They cover why location-based conditional access falls short, how behavioral identity threat detection and response (ITDR) catches Microsoft 365 account takeover in under a minute, and which tenant hardening steps reduce your exposure.

Navigate the Microsoft AI ecosystem with host Nathan Taylor and Microsoft's Ricky Lawson as they break down Microsoft Cowork, Microsoft Scout (now Autopilot), and M365 Copilot agents. Learn how the July 1st shift to Copilot credits impacts your AI strategy, discover effective Copilot FinOps practices, and determine when to leverage autonomous Cowork orchestration versus lightweight in-app agents across Word, Excel, PowerPoint, and Outlook.

AI is moving faster than most budgets can keep up with. In this episode of Demystifying Microsoft, host Nathan Taylor sits down with Graham Rosenberg, Director of Intelligence and Automation at Sourcepass, to unpack one of the most urgent conversations in the Microsoft ecosystem today: AI FinOps for Microsoft Copilot.

Device code flow attacks are exploding across Microsoft 365 environments in 2025, and they bypass many of the security controls organizations rely on, including FIDO2 keys, MFA, and conditional access. In this episode of Demystifying Microsoft, host Nathan Taylor breaks down exactly how these attacks work, why threat actor groups like Storm-2372 are leveraging phishing-as-a-service kits like Octopi365, FlowerStorm, and EvilTokens to industrialize the attack, as well as how to detect and block device code phishing in your own tenant.

Taking charge of your meeting summary notes isn’t the only thing Copilot is built for. It is capable of handling all other meeting processes starting from configuration all the way to referencing. In this episode of Demystifying Microsoft, Nathan Taylor, SVP Global Microsoft Practice Leader at Sourcepass, explores how Microsoft 365 Copilot can transform meetings from passive conversations into actionable insights, using tools like Facilitator, Loop and WorkIQ. These features help to capture context, automate tasks and make information searchable. Nathan also shares how he uses these capabilities in his own day-to-day work to stay on top of meetings, customers and projects. Tune in to learn how to optimize Microsoft Copilot for your meetings and organization.