TeamViris

In a recent incident, my colleague @schnee_FLO_cke investigated a compromise of a Microsoft Entra Global Administrator account. The user fell for a simple phishing attempt (see screenshot) and handed over the key to the cloud kingdom to the attacker. After accessing the tenant, the attacker compromised several mailboxes, set up multiple mailbox rules, and accessed numerous emails. We investigated the compromise of a GA account before [1]. As Microsoft put it: "Global Admins have almost unlimited access to your organization's settings and most of its data." [2] Follow basic security principles to protect the GA accounts: * Require MFA for all Global Admin accounts. * Use just-in-time access with Privileged Identity Management (PIM) for admin tasks. * Set Conditional Access Policies: Restrict login locations and enforce security requirements. * Monitor risky sign-ins and compromise alerts. * Use Dedicated Admin Accounts: Avoid using Global Admins for daily tasks. Good luck ☘️ [1] teapawt.net/malmoeb/status/1610979… [2] learn.microsoft.com/en-us/mi…