Small businesses owners have been told the same thing for years: “Turn on MFA and you’ll be much safer.”
That advice still matters. Multi-factor authentication is one of the best security steps a business can take. But it is not a magic shield.
Attackers know this. They have stopped simply trying to steal passwords. They are now looking for ways to trick people into approving access through legitimate Microsoft sign-in processes.
That is where things get uncomfortable.
The login page can be real.
The MFA prompt can be real.
The person can approve it themselves.
The password may never be stolen.
Yet the attacker can still end up with access.
The new problem: attackers are not always “breaking in”
A lot of Microsoft 365 attacks now look more like someone being let in through the front door.
One growing technique involves device code authentication. This is a genuine Microsoft sign-in method, designed for devices that are awkward to type into, such as TVs, printers, command line tools and some internet-connected devices.
In the right setting, it is useful. In the wrong hands, it becomes a neat trick.
A person receives a convincing email. It might mention a voicemail, invoice, document approval, shared file or signature request. They are asked to enter a code on a real Microsoft page. Because the page is genuine, it feels safe.
They complete the sign-in. MFA is approved.
The attacker gets tokens that can allow access to cloud services.
No fake Microsoft login page required.
No obvious password theft.
No classic “you’ve been hacked” moment.
That is why this type of attack is so dangerous for Microsoft 365 environments.
Why this matters to small businesses
For many small businesses, Microsoft 365 is where the business lives.
Email.
Files.
Invoices.
HR records.
Client conversations.
Supplier details.
Finance threads.
Password resets.
Shared documents.
Teams chats.
If an attacker gets into the right mailbox, they are not just reading emails. They are learning how the business works.
They can watch invoice conversations.
They can create mailbox rules to hide replies.
They can search for finance-related emails.
They can impersonate someone trusted.
They can send a payment request from a real account.
They can move quickly from account compromise to business email compromise.
That is the bit many businesses miss. The damage does not always start with ransomware. It can start with one cloud account that looks, at first glance, like it logged in normally.
MFA helps, but monitoring identity behaviour matters too
MFA reduces risk. It should still be enabled, but modern attacks are increasingly designed to work around the assumptions businesses make about MFA.
If an attacker can persuade someone to approve a legitimate sign-in flow, your business needs a way to spot what happens next.
That means looking for things like:
Suspicious sign-in locations.
Unusual user agents.
Unexpected Microsoft 365 activity.
New or strange inbox rules.
Token abuse.
Impossible or unlikely travel.
Access patterns that do not match normal behaviour.
Signs of business email compromise.
That is identity threat detection and response, or, in plain English, watching your cloud logins and Microsoft 365 activity for the things a busy person will not spot.
Where Huntress ITDR fits
Huntress Managed ITDR is built for this problem.
It watches identity activity across Microsoft 365 and helps detect signs of account takeover, suspicious logins and business email compromise. It is backed by the Huntress 24/7 human-led SOC, so alerts are not just dumped in your lap for you to work out on your own.
Small businesses do not usually have someone sitting in front of Microsoft Entra logs all day.
They do not usually have time to investigate whether a login from an unusual location is harmless, risky or already part of an attack.
They may not know which inbox rule is normal and which one has been created to hide replies from a finance director.
They may not know when a user’s account needs sessions revoking quickly.
Huntress ITDR gives smaller organisations a practical way to add identity monitoring without building an internal security team.
Why identity security is now part of business protection
For years, cyber security was often seen as antivirus, firewalls and backups.
Those still matter, but the cloud has changed the shape of the problem.
A business can have decent endpoint protection and still suffer badly if a Microsoft 365 account is compromised.
- A laptop might be clean.
- The firewall might see nothing unusual.
- The password might not have been stolen.
- The person may have approved MFA.
- And the attacker may still be inside the mailbox.
That is why identity has become one of the most important areas of cyber security for small businesses.
Your Microsoft 365 accounts are now keys to the business. They deserve proper monitoring.
Huntress ITDR helps answer the awkward questions
A good identity security setup helps answer questions such as:
- Has someone logged in from somewhere unusual?
- Has a mailbox started behaving differently?
- Has a risky session been created?
- Are there signs of account takeover?
- Has someone created suspicious inbox rules?
- Could this lead to invoice fraud or data loss?
- Do we need to revoke sessions?
- Do we need to reset credentials?
- Do we need to investigate other accounts?
Without monitoring, these questions often get asked too late.
- After the payment has gone.
- After the mailbox has been watched for weeks.
- After the client has received a convincing fake email.
- After the attacker has had time to learn the business.
The benefit is not just detection. It is speed.
With cloud account compromise, speed matters. If you spot suspicious identity activity quickly, you have a better chance of stopping the damage early.
- That may mean revoking active sessions.
- Disabling risky access.
- Resetting credentials.
- Removing malicious inbox rules.
- Checking related accounts.
- Reviewing what data may have been accessed.
- Warning finance teams before a fake payment request lands.
- The longer an attacker sits inside a mailbox, the more useful that access becomes.
Huntress ITDR helps reduce that gap between compromise and response.
This is not just an enterprise problem
It is easy to think these attacks only affect large organisations.
They do not.
Smaller businesses are attractive because they often have:
- Microsoft 365 heavily embedded in daily work.
- Limited internal IT resource.
- No dedicated security team.
- Finance processes built around email.
- Trusted relationships with clients and suppliers.
- Insurance or compliance pressure.
- Busy staff who are trying to get work done.
That is the perfect setting for identity-based attacks.
The email looks normal.
The sign-in page looks normal.
The code request feels plausible.
The damage starts quietly.
What we recommend
At Black Swan Cyber Security Solutions, we see Huntress ITDR as part of a sensible Microsoft 365 security layer for small businesses, schools, care providers, charities and professional services firms.
It should sit alongside:
- MFA.
- Conditional Access.
- Phishing-resistant sign-in where suitable.
- Good staff awareness.
- Secure email filtering.
- Endpoint protection.
- Backups.
- Clear processes for payment changes and invoice requests.
Huntress ITDR does not remove the need for good Microsoft 365 configuration. It strengthens the position by adding managed monitoring and response around the identities attackers are now targeting.
If your business relies on Microsoft 365, your accounts need more than passwords and MFA.
- You need to know when a login does not look right.
- You need to know when a mailbox starts behaving strangely.
- You need someone watching for signs of account takeover and business email compromise.
That is the value of Huntress Managed ITDR.
It helps protect the part of your business attackers are increasingly aiming for: your cloud identities.
If you use Microsoft 365 and want to know whether your accounts are being properly monitored, Black Swan Cyber Security Solutions can help you review your current setup and show where Huntress ITDR fits.
