Most of the serious breaches we get called into did not start with malware. They started with a correct password.
That distinction matters because it changes what you need to be watching. Antivirus looks for bad files. Firewalls look for bad traffic. Neither one has anything to say about a valid employee logging in with the right credentials and then doing ordinary things in an unusual order.
An identity access management solution is the set of controls that governs who can sign in, what they can reach once they are in, and whether anyone is watching the pattern. For a company running on Microsoft 365, that mostly means Microsoft Entra ID, which is the identity service sitting behind your email, your files, and your Teams. It is already in your license. It is usually not configured.
Here is why that matters, walked through one attack at a time.
A note on what follows: the company is a composite, not a client. The sequence is not invented. It follows the pattern Sophos incident responders document repeatedly in business email compromise cases, and the intervals and dollar figures are ordinary for what happens to companies this size in Minnesota.
The company is a 40-person construction firm outside Duluth. One bookkeeper handles accounts payable. An operations manager reviews invoices. A controller in the Twin Cities office approves payments. Microsoft 365 for email, an accounting package for the books, a firewall in the server closet, and current antivirus on every workstation, all reporting clean.
Step 1: A password is stolen somewhere else entirely
The bookkeeper uses the same email and password for her work account and a small online home goods store. In March, the store is breached. Its customer table, passwords included and stored in plain text, is taken.
Within a few weeks that table has been sorted by email domain. Everything ending in the construction firm’s domain gets bundled and listed for sale. A few dollars per credential. Sophos X-Ops tracked a 106% increase in stolen credentials offered on one major marketplace between June 2024 and June 2025, which is to say the supply is not scarce and the price is not a barrier.
Step 2: The login works
Two weeks later an automated tool runs the credential against the Microsoft 365 sign-in page. It works. The account has no multifactor authentication on it.
From Entra ID’s point of view this is a successful sign-in. Right username, right password. The connection comes from a residential IP in another state, which would be worth a second look, except that half the office works from home some days and there is no conditional access policy in place to treat an unfamiliar location differently from a familiar one.
This is the step where MFA would have ended the whole thing. A push notification, a hardware key, a biometric check, any second factor at all, and a password bought for four dollars is worth nothing.
Step 3: Six days of reading
The attacker signs in once each morning and reads email. That is the entire activity for close to a week.
They search for the words that matter: invoice, ACH, wire, payment, and the names of vendors that show up every month. They work out which supplier sends the biggest invoices, who reviews them, who approves them, and how long approval usually takes. They do not send anything. They do not download anything to an unusual place. They do not install software.
This is where behavioral monitoring earns its keep, and where most Microsoft 365 tenants have nothing turned on. A bookkeeper who has never signed in from Indiana, at 4:00 a.m. Central, from a browser she has never used, is a deviation worth a phone call. Entra ID can flag exactly that. The signal exists. In most of the environments we assess, nobody has configured anything to act on it.
Step 4: A mailbox rule hides what comes next
On day seven, the attacker adds a rule to the bookkeeper’s mailbox. Any incoming message containing the steel supplier’s name along with the word bank or account moves straight to Deleted Items.
Exchange Online treats this as a configuration change made by the account holder. It is the same event type as someone filing newsletters into a folder. It is written to the audit log and it is not, by default, treated as a security event.
Inbox rule creation on a finance account is one of the highest-value alerts available in Microsoft 365 and one of the least often switched on. On an account that touches vendor payments, a new rule that quietly deletes vendor mail should wake somebody up inside of a few minutes.
Step 5: A real invoice, two changed fields
A week later the steel supplier in St. Cloud emails a genuine invoice for $92,000 to the accounts payable address. It lands in the bookkeeper’s mailbox and the rule from step four moves it to Deleted Items before she ever sees it.
The attacker opens it, downloads the real PDF, and edits two fields: the routing number and the account number. Vendor name, invoice number, project reference, line items, and total all stay exactly as the supplier sent them. Then the modified invoice goes into the normal approval chain, forwarded from the bookkeeper’s own mailbox, as a reply in the thread that was already running.
The From address is correct. The thread is the one the operations manager has been reading for two years. The vendor is right, the project is right, and the amount is close to what that supplier always bills.
There is no lookalike domain here and no misspelled sender. It is the real thread, altered from inside by someone holding a real account.
Step 6: Everyone follows the process correctly
The operations manager reviews the invoice and replies with a question about a line item. The attacker, still sitting in the mailbox, answers it using details pulled from older threads. The answer is specific and it arrives fast.
The operations manager signs off. The controller approves it, having seen invoices from this supplier at similar amounts for similar materials for years. The ACH goes out to the account number on the invoice, which belongs to the attacker at a regional bank several states away.
Nobody clicked a bad link. Nobody dismissed a warning. Nobody skipped a step. Every person in the chain did their job the way they were trained to do it.
The firm finds out five days later, when the supplier calls to ask where the payment is. By then the receiving account is empty.
Why nothing caught it
Go back through the six steps and look for the moment a traditional security tool had something to act on. There isn’t one.
A valid login. Email read by its own owner. A rule created by the account holder. A PDF opened and forwarded internally. A payment approved by the people who are supposed to approve payments. Each action is legitimate in isolation. What made the sequence an attack was the pattern: the location, the hour, the order, and the fact that the account had never behaved that way before.
File-based detection cannot see that. Identity-based detection is built for it.
Sophos put the scale of this in its Active Adversary Report 2026: in 2025, 67% of attack root causes traced back to compromised identities. More than half the organizations in that dataset had 250 employees or fewer. This is not an enterprise problem that trickles down. It is the main way small and midsize companies get hit, because small and midsize companies are the ones running Microsoft 365 on default settings.
Where the gaps usually are
Sophos incident response found critical misconfigurations in 95% of the Microsoft Entra ID environments it examined during real investigations. Not unusual configurations. Critical ones. The practical version of that number is that your identity service almost certainly has a hole in it right now, and it is probably one of these:
- Finance accounts with no MFA, or with MFA showing as enabled in the admin console while never actually being enforced on the user
- Shared mailboxes handling accounts payable, where no individual is accountable for any action taken
- Global admin accounts used for daily work instead of being reserved for admin tasks
- Privileged accounts nobody has reviewed since the tenant was first set up
- Guest accounts belonging to contractors who finished a job two years ago and still have access to SharePoint
- No alerting on inbox rule creation, which is the single cheapest detection on this list
The MFA one deserves a second look, because it is the one that costs money twice. Cyber insurance applications ask whether MFA is enforced. Claims get examined against what was actually configured, not what was answered on the form. A policy answer of yes against a tenant that says no is a denied claim on top of a wire you are not getting back.
The objection worth answering
Owners and CFOs usually raise the same thing: more security means slowing everyone down.
It does, when it is bolted on badly. If MFA prompts fire every time somebody opens a laptop, people find shortcuts, and the shortcuts become the new problem. Configured properly it goes the other direction. Single sign-on means one strong login instead of six weak ones. Conditional access stays invisible during a normal Tuesday in the office and tightens only when something looks off, like a sign-in from a country nobody works in. Password resets, which are the most common help desk ticket in most small companies, drop.
None of the controls in this article are exotic. Passwordless sign-in, enforced MFA, conditional access, role-based permissions, alerting on mailbox rules, and a second human confirming any change to vendor bank details by phone using a number already on file. Most of them are sitting unused in a Microsoft 365 license you already pay for. What they need is configuration, enforcement, and somebody checking.
Find out what your identity logs would have shown
The attack above was visible the entire time. Every step generated a record. Nobody was reading them.
Sophos surveyed 377 U.S. organizations hit by ransomware for its State of Ransomware in the U.S. 2026 report, and the credential findings are the part worth your time: how often stolen logins are the entry point, what the attackers do in the window between signing in and being noticed, and which identity controls actually shortened that window.
Deerwood Technologies is a veteran-owned managed IT and cybersecurity provider in Deerwood, Minnesota, working with businesses across the Upper Midwest. If you would rather start with your own environment than a report, we will walk through through your Microsoft 365 identity configuration and show you what is on and what is not.