Microsoft published a breakdown this year of an intrusion where nobody cracked a password.
The attacker started a password reset on an employee's behalf, then talked that person through approving the prompts that followed. From there they used the permissions that account already carried to move through the company's cloud environment — pulling dozens of stored credentials in four minutes.
The targets weren't random. They included IT staff and senior leadership. The people whose accounts hold permanent keys to everything.
I see the same setup in most practices I walk into. The office manager has full admin rights. So does the owner. So does the IT person who left in 2023. Nobody granted that on purpose — somebody needed it once and it never got taken back. It's a master key on every keychain in the building because once a year someone opens the supply closet.
The fix isn't complicated. Admin rights that switch on when they're needed and off after. A separate account for admin work. Stronger sign-in for anyone holding those rights.
For a medical practice, three days without scheduling and records isn't an IT problem. It's every patient rescheduled, every call made by you, and a very different cyber insurance renewal.
Ask whoever runs your IT one question: how many accounts here have permanent admin rights right now? If the answer takes more than a minute, that's the finding.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email