5 articles
Microsoft disrupted EvilTokens, an AI-assisted phishing kit that tricked people into entering device codes on the real Microsoft sign-in page. How it looks for Outlook.com users, what not to do, and how to check recent activity.
Security Defaults vs a short Conditional Access starter pack for Microsoft 365 shops under fifty people — MFA, legacy auth, and break-glass, not a 40-policy mess.
A practical path to require multifactor authentication in Microsoft 365 for a small business, without locking everyone out on Friday afternoon.
Why the CEO's mailbox is the first account that deserves FIDO2 or passkeys, not another SMS code.
How to create and maintain emergency Microsoft 365 admin accounts so you can recover the tenant without leaving a permanent backdoor.
