BEC-ware the Phish (part 2): Respond and Remediate Incidents in M365

This guidance outlines response and remediation workflows for Microsoft 365 Business Email Compromise, focusing on rapid containment (disable accounts, reset passwords, revoke/rebind tokens), automated actions via Defender AIR and Sentinel playbooks, and short-term restoration steps. It then prescribes longer-term controls—MFA (prefer phishing-resistant), Conditional Access with authentication strength and CAE, token binding, app-consent governance, Intune-enforced compliant devices, least privilege, and privileged account separation—along with validation and monitoring practices to prevent re-compromise and harden the environment.