The challenge
- A compromised account. In August 2026 an attacker took over an employee’s account.
- A second employee targeted. Another employee received hundreds of emails in about 40 minutes, and a phishing email the next day.
- Warning signs nobody saw. High-risk sign-ins to the account had been logged in the months before the breach, with no alert to anyone.
- Open doors. Device code sign-in, app passwords, and SMS-based MFA.
What we did together
1Investigating and closing the incident
Building on the company’s own IT report and the Entra logs, we found what hadn’t come up yet: a second employee who was targeted, early warning signs from the months before the breach, and another sign-in attempt about a month later, which was blocked.
The benefit: The company knows exactly what happened. By all the evidence, the incident is over, with no open issues left.
2Mapping the gaps with Griffin31
We checked the environment against more than 350 recommendations. The mapping showed which threats and attack vectors apply to this tenant, and set the order of work in three stages:
- First, the threats and attack vectors.
- Then the quick wins.
- Last, a longer-term plan.
The benefit: Instead of a long list of settings, the company knew what to close first, and why.
3A detailed work plan
Built from the mapping, across five areas: identity and access, devices, email security, Defender for Endpoint and phones. Every action has a timeline and starts with a pilot.
The benefit: Hardening in waves, without stopping people’s work.
4Access: only a verified user on a healthy device
Syncing Active Directory to Entra ID, Conditional Access policies that block device code flow and app passwords, risk-based policies, phishing-resistant MFA and a compliant-device requirement.
The benefit: The attacker’s way in is closed. A leaked password is no longer enough to sign in.
5Devices: Intune, Defender and automatic updates
Enrolling the computers in Intune, Microsoft’s security baseline, compliance policies, Defender for Endpoint in place of the previous antivirus, and moving Windows updates from WSUS to Intune.
The benefit: Every computer follows one standard, is protected and updates itself. A device that doesn’t meet the requirements can’t reach company data.
6Email: impersonation and phishing protection
Defender for Office 365 with strict protection for finance, management and admins, user and domain impersonation protection, Safe Links and Safe Attachments.
The benefit: Impersonation emails and malicious links are stopped before they reach people.
7Phones: company data protected on personal devices
App protection policies on iOS and Android: PIN or biometrics, encryption, no copying to personal apps, and wiping company data only.
The benefit: People work from their phones, and company data stays inside company apps.
8Verification and ongoing monitoring
At the end we confirmed in Griffin31 that the environment is healthy and the gaps are closed. Since then Griffin31 scans the environment and sends an email alert when a security setting gets weaker, and on sensitive changes in Entra ID.
The benefit: The hardening doesn’t wear down over time. If a setting gets weaker, the IT team knows after the next scan.
What changed
Think an account in your organization was compromised? Start with a review of your logs and security settings.
Book a call