The Microsoft 365 compromise I'd worry about most doesn't involve a stolen password. It involves someone on your team clicking "Allow."
Every time a tool connects to Microsoft 365 — an e-signature service, a PDF utility, a scheduling add-in — a consent screen appears asking for permission to read mail, files, or contacts. Most people skim it and click through. That grant then sits in your tenant. It doesn't expire when the employee changes their password, and it never asks again.
Attackers build for that click. Researchers have found malicious apps impersonating Adobe and DocuSign — names your staff sees twenty times a day during filing season. Microsoft's own security team published guidance this year telling organizations to limit who can consent to apps, review the permissions already granted, and remove anything unused or over-permissioned.
For a CPA firm, that's not abstract. Your tenant holds every client's financials. An app with mailbox access is a quiet, permanent reader of your email — and it never shows up as a failed login, because nothing was broken into. It was handed over.
Pulling the list of what's already connected to your tenant takes about ten minutes. The names on it are usually the surprise.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email