Articles

Plain-English writing on Microsoft 365 security and configuration-as-code — what actually goes wrong in real tenants, and what it takes to keep it from happening again.

Security September 7, 2026 · 9 min read

How Microsoft 365 Accounts Get Compromised — And Why MFA Didn't Stop It

The two routes attackers actually use: a relay page that captures the session token after a genuine MFA approval, and a compromised device whose tokens are copied and replayed elsewhere. Includes a full attack-path flowchart and the controls that break the chain.

Read article