Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft IR details a surge in identity-focused attacks and the most common Microsoft Entra ID/hybrid identity weaknesses that enable tenant compromise—such as compromised AD FS, token theft via AiTM and malware, excessive user/workload privileges, Conditional Access gaps, device and application access misconfigurations, risky partner (DAP) rights, OAuth consent phishing, and SSPR/MFA social engineering—and provides prioritized mitigations including adopting native Entra authentication, least privilege and PIM, phishing-resistant MFA, hardened admin workstations, strong logging and monitoring, Conditional Access simplification and enforcement, granular partner access (GDAP), and token protection to reduce paths to tenant takeover.