January framed the year. Midnight Blizzard — the actor Microsoft attributes to Russia's foreign intelligence service — got into Microsoft's own corporate environment without a single zero-day. A password spray against a legacy, non-production test tenant account that lacked MFA. Then abuse of an old OAuth test application that held elevated access into the corporate tenant. Then mailbox reads against senior leadership, including the security and legal teams. Disclosure came January 19, with worse details arriving through spring.
The tempting reading is schadenfreude. The correct reading is that if the company that builds Entra ID can be entered through a forgotten test tenant, so can you, because everyone has that tenant — the 2019 proof of concept, the app registration with a consent grant nobody remembers approving, the subscription that arrived with an acquisition. Identity work in 2024 is partly archaeology.
There is also a deadline flavor to this month: Microsoft is beginning phased enforcement of mandatory MFA for sign-ins to the Azure portal, the Entra admin center, and the Intune admin center, with CLI, PowerShell, and infrastructure tooling to follow next year. The floor is rising on its own. What follows is about the parts above the floor — the privileged-access work most estates started around 2021 and never quite declared done.
What January actually teaches
Three specifics, none of them Microsoft-shaped. First, non-production identity is production attack surface. Test tenants, dev registrations, and pilot subscriptions do not appear on architecture diagrams, but they authenticate against the same internet as everything else. Second, OAuth grants are the durable backdoor: an application holding full_access_as_app to Exchange Online is functionally a domain admin for mail, it survives every password reset, and it is invisible to a review process that only looks at users and groups. Third, password spray still works in 2024 — which is an empirical statement about how many accounts somewhere lack MFA, not a statement about attacker sophistication. The same actor was reported inside other large vendors' mailboxes this year through the same class of door, so treat this as a category lesson rather than a company anecdote.
The homework falls out directly: an inventory of every tenant your organization actually owns, including the ones Procurement has never heard of; every service principal holding high-privilege Graph or Exchange roles; and every credential on those applications, with its age.
PIM, but finished this time
A publicly traded building-products manufacturer we support started Privileged Identity Management in 2022, like nearly everyone. This quarter it got finished, and the delta between installed and finished is the entire point of this section.
Finished means: zero standing Global Administrators. Every admin role is eligible rather than active, with the two break-glass accounts as the only exceptions. Activation requires MFA, a business justification, and a ticket number; Global Admin, Privileged Role Admin, and Security Admin additionally require an approver who is not the requester. Activations are time-boxed at four hours — eight for the operations roles that genuinely babysit long changes. Monthly access reviews remove anyone who has not activated in ninety days. And an alert fires when any privileged assignment is created outside PIM, because that is either an emergency or an attacker, and both deserve a page.
Getting from fourteen standing Global Admins to zero took two years, and the last three were the hard ones: a vendor account that was temporary in 2021, an ERP integration granted Global Admin during a crisis go-live, a monitoring product whose documentation insisted it needed everything. Each turned out to need a far narrower role — scoped with administrative units in two cases, replaced by a workload identity in the third. The tail is the project. The first eleven were a pilot that flattered everyone.
Two supporting pieces make the finished state livable. Privileged access workstations — or at minimum a hardened, separately profiled admin browser session — for the roles that survive, so an admin's daily-driver malware problem does not graduate into a tenant problem. And a monthly report of activation counts by role, because a role nobody has activated in a quarter is a role you can probably delete, and a role activated daily deserves a hard look at whether some automation is holding it wrong.
Break-glass that survives both an outage and an audit
Two accounts, cloud-only, on the tenant's own onmicrosoft.com domain, so a federation or hybrid failure cannot lock them out. Excluded from Conditional Access — which means their protection cannot be a policy and must be the credential itself. In a year when MFA on admin portals is becoming mandatory, the old ritual of a long password in a sealed envelope is aging badly. We have been moving clients to FIDO2 hardware keys for break-glass: two keys per account, stored in separate safes at separate sites, with the loss-and-recovery story written down for both. The phased portal enforcement does allow tenants to postpone their date, and postponement is a reasonable bridge while keys are procured and enrolled — but it is a bridge, and it has a far end.
The part most estates skip is monitoring and rehearsal. Any sign-in by either account pages the SOC and texts two named humans — legitimate use is rare enough that false positives cost nothing. Quarterly, someone retrieves the key from the safe, signs in, confirms the alert actually fired, performs one harmless privileged read, signs out, and logs the drill. A break-glass account that has never been exercised is not a control. It is a hypothesis in a fireproof box.
Workload identities, the part with no owner
User identity gets reviewed because auditors ask about users. Application identity mostly does not, which is why January's attack lived there. The recurring findings when we assess a tenant: client secrets with multi-year lifetimes, some set programmatically to expirations the portal will not even display; applications whose only owner left in 2021; consented-but-unused applications holding directory-write or mailbox-wide roles; and secrets sitting in pipeline variables, one repo misconfiguration from daylight.
The hygiene program is not subtle. Inventory every app role assignment that touches mail, files, or the directory at tenant scope, and make a human argue for each one. Replace secrets with certificates where a credential must exist at all; prefer managed identities inside Azure and workload identity federation for external CI, both of which remove the storable secret entirely. Mandate two owners per application; orphans get a thirty-day clock and then deletion. Alert on new credentials added to privileged applications — that exact move was in January's playbook. A starting inventory is one query:
Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -All -Property DisplayName, PasswordCredentials |
ForEach-Object {
foreach ($c in $_.PasswordCredentials) {
[pscustomobject]@{
App = $_.DisplayName
Expires = $c.EndDateTime
AgeDays = [int]((Get-Date) - $c.StartDateTime).TotalDays
}
}
} |
Where-Object { $_.AgeDays -gt 365 } |
Sort-Object AgeDays -Descending
Anything on that list older than a year has outlived its excuse.
A Conditional Access baseline you can defend out loud
We keep seeing forty-policy estates where nothing is enforced and everything is report-only, which is a way of being busy instead of safe. Five policies, enforced, beat thirty in committee:
| Policy | Scope | Notes |
|---|---|---|
| Block legacy authentication | all users | report-only for a week to find the one copier still doing SMTP AUTH, then enforce |
| Require MFA | all users, all cloud apps | the October platform enforcement covers admin portals; yours should cover everything |
| Phishing-resistant strength for admins | all privileged roles | authentication strengths: FIDO2, Windows Hello for Business, certificate-based |
| Require compliant device | Microsoft 365 workloads | doubles as token-theft friction, per the next section |
| Block high sign-in risk | where licensed | an Identity Protection signal, not a substitute for the rest |
| Restrict device-code flow | all users, exempting devices that need it | the authentication-flows condition exists for this; device-code phishing went from conference talk to commodity this year |
Exclusions are where baselines go to die: break-glass accounts only, and an access review on every other exclusion group so that temporary stops meaning permanent with better branding.
Assume the token gets stolen
The phishing that works in 2024 is adversary-in-the-middle. A commodity kit proxies the real sign-in page, the user completes real MFA, and the attacker keeps the session cookie. Number-matching does not help — the user approved a genuine prompt for a genuine session; it just was not their session alone. Ranked honestly: phishing-resistant methods kill the proxy outright, because the credential is bound to the origin — which is why the admin-tier requirement above is not optional decoration. A compliant-device requirement makes a replayed cookie from attacker infrastructure fail the policy check — partial protection, but real friction. Continuous access evaluation shortens the life of whatever does get stolen. Token protection is in preview with narrow coverage: watch it, do not lean on it. And add a honeytoken if your SOC has the appetite — a plausible-looking service account that nothing legitimate should ever touch, wired to page on first use, remains the cheapest high-fidelity alert you will deploy this year.
Detection is the other half — ITDR, if you want this year's acronym. Defender for Identity on the domain controllers. Identity Protection risk events routed to humans who triage them, not to a mailbox named after a project that ended. Hunting for consent grants to new multi-tenant applications, inbox rules created minutes after a risky sign-in, and privileged apps quietly gaining credentials. January's tradecraft was visible in exactly those places, at the one company whose telemetry we all got to read about. Yours will look the same.
If you're facing this
If your privileged-access program has been eighty percent done since 2022, the remaining twenty percent is the part attackers actually use, and this is a defensible quarter to finish it. We have closed this gap for several estates this year, usually inside ninety days, and can show you what finished looks like. Reach out.