CISA Calls on Organizations to Strengthen Microsoft Intune Security After Stryker Incident

**Executive Summary:** CISA issued an urgent March 18, 2026 alert after a March 11 compromise of Stryker Corporation where attackers misused legitimate endpoint management and administrative capabilities (notably within Microsoft Intune/Entra) to impact corporate Microsoft infrastructure; the advisory urges immediate hardening via least-privilege RBAC, phishing‑resistant MFA, Conditional Access and Privileged Identity Management, and Multi Admin Approval to prevent unilateral, high‑impact administrative actions.