What Is ITDR? Identity Threat Detection and Response

Identity Threat Detection and Response (ITDR) helps detect signs that someone else may be using your Microsoft 365 account and take action to stop their access.

Many businesses live on Microsoft 365. So do today’s cyber criminals who know it holds emails, files, important business data, and conversations. If they gain access via an identity-based attack, they can read sensitive data or send messages in your name – even while you continue using it normally.

To help you understand the identity threats ITDR helps protect against, this article explains five common threats through short videos. 

What is an identity threat in Microsoft 365?  

Employees use their Microsoft 365 accounts to read work emails, access files, and communicate across the business. That access makes these accounts a valuable target for cybercriminals. 

Cybersecurity company Huntress, defines an identity threat as an attempt to steal, misuse or impersonate a digital identity. In plain English, this means a cybercriminal is trying to use an account to read sensitive business information, act as an employee or gain access to other parts of the business. 

The video below introduces five common identity threats before the following sections explain in detail how each threat works and what you can do to reduce the risk. 

Once an attacker gains access, they may be able to use the account as if they were the employee. For example, they could send an invoice from a genuine accounts team mailbox but replace the bank details with their own. Because the email comes from a familiar address, colleagues, customers or suppliers may trust it. 

Attackers do not always need a password to gain access. Between 14th July and 22nd September 2026, Huntress investigated a campaign in which criminals stole the digital passes that keep users signed in to Microsoft 365, then reused them to access accounts. 

Huntress identified 497 successful attacker sign-ins across 79 organisations during that campaign.  

These attacks can be difficult to notice because the employee may still be using their account normally. Understanding the five identity threats below can help you recognise warning signs, reduce the risk, and know when to contact IT.

Which identity threats can ITDR help detect? 

The following five examples show how attackers can obtain access to Microsoft 365 accounts or keep it.  

1 – Credential Theft  

What is credential theft and how can it affect your work account? 

Credential theft means an attacker obtains someone’s sign-in details or other information used to access an account. This section focuses on stolen usernames and passwords. 

An email may pretend to be a shared document, delivery update, or urgent account warning. Its link takes you to a fake sign-in page that captures what you type, as shown in the video below.

Attackers can also obtain passwords through malicious software or try passwords leaked from another service, hoping you reused them for work.  

How can a credential theft attack put your business at risk? 

A correct password can make an attacker sign-in appear legitimate. They may want to read messages or impersonate you without locking you out. 

How can you protect your business against credential theft? 

• Use a unique work password. 
• Use an approved password manager.  
• Keep MFA enabled. 

Ionic IT’s tip – Check whether your email address has appeared in a known data breach using Have I Been Pwned.

A breach result on the tool does not prove that your current work account is compromised. The HIBP guidance explains what the results mean. 

If your email has been involved in a compromise, review the affected services and change any exposed passwords that are still in use. 

How does ITDR help detect credential theft? 

Huntress’s Unwanted Access feature looks for signs that stolen sign-in details are being used, such as unusual sign-ins or changes in the device or browser accessing an account. 

This can help your IT team identify an attacker even when they are using a correct password. The video above shows how credential theft can start and how to check whether your email address has appeared in a known breach

2 – Adversary-in-the-middle (AiTM) attacks 

What is an adversary in the middle attack? 

An adversary-in-the-middle (AiTM) attack uses a fake sign-in page to steal the digital “pass” that keeps you logged in. The page passes your sign-in details to the real service, so your login and MFA approval may appear to work normally while the attacker captures that pass. 

You might receive a convincing email asking you to open a document or sign an agreement. The page looks familiar, and your usual MFA request may appear. You complete it, but the attacker obtains a digital pass showing that the sign-in succeeded. 

Watch how a fake sign-in link can lead to account access even after an MFA approval.

How can AiTM attacks put your business at risk? 

AiTM attacks can begin with an email that looks like a normal work request. Huntress’s Knight Office investigation described an attack that used a DocuSign-style email and sent the victim through several websites to hide the final fake sign-in page. 

These attacks can also reach businesses at scale, emphasised via a March 2026 report from Microsoft. They reported Tycoon2FA, a tool used to run AiTM attacks, enabled phishing campaigns reaching more than 500,000 organisations each month. This describes their reach, rather than the number successfully compromised. 

For your business, the risk is that an employee could complete their usual sign-in and MFA check while unknowingly giving an attacker access. The criminal may then be able to read business emails, access files, or send messages in the employee’s name.

How can you protect your business against AiTM attacks? 

• Open work services through a trusted app or saved bookmark when an unexpected message asks you to sign in. 
• Never approve an authentication prompt you did not start. 
• Ask IT about phishing-resistant sign-in options, such as suitable passkeys or security keys. 

How does ITDR help detect AiTM attacks? 

ITDR can look for signs that someone else is using your account after you have completed MFA. This helps your IT team investigate suspicious activity that a successful sign-in alone would not reveal. 

3 – Shadow Workflows and malicious inbox rules 

What is a shadow workflow attack? 

Huntress use the term shadow workflows for malicious inbox rules and related changes that help attackers hide their activity. An inbox rule is an instruction that automatically handles incoming email. An attacker might create one to forward messages outside the organisation or hide replies and security alerts. 

After gaining mailbox access, an attacker creates a rule in the background as shown in the video below. Your inbox may continue to work normally while selected messages are copied, moved or deleted. 

How do shadow workflow attacks put your business at risk? 

In its 2026 report, Huntress said mailbox manipulation accounted for 19% of identity-based attacks in its observed 2025 dataset.  

An attacker could secretly forward copies of your emails to their own inbox, allowing them to follow conversations with suppliers or clients. Once they know a payment is due, they could use that information to send a convincing request to change the bank details. 

They may also create rules that hide replies or security alerts, making the fraud harder to spot. This can lead to financial losses and damage the trust your business has built with its contacts.

How can you protect your business against shadow workflow attacks? 

In Outlook on the web, review: 

• Settings > Mail > Rules – Look for instructions you do not recognise, especially those that forward, move or delete messages. 
• Settings > Mail > Forwarding – Check whether messages are being sent to an unfamiliar address. 
• Tell IT about an unfamiliar forwarding address, missing replies or rules you cannot explain.  
• Ask IT to investigate – Some hidden rules are not visible in your normal email settings. 

How does ITDR help detect shadow workflow attacks? 

After gaining access to an account, an attacker may create an email rule that secretly sends copies of messages to an outside address. Your inbox can still look normal, making this easy to miss. 

ITDR helps flag suspicious changes like these, so your IT team can investigate and take action to secure the account. 

The video above shows how this works. Use the checks above to review your email rules and forward settings, and report anything unfamiliar to IT.

4. Rogue application attacks

What is a rogue application attack? 

A rogue application is an app that attackers use to access your work emails, files or other business information. It could be a fake app or a genuine app that has been compromised. 

As Huntress explains, attackers can gain access when someone accepts an app’s permission request, such as “Read your email”. This can let the app access information without needing your password, as shown in the video below.  

An app that looks useful, such as a document helper, may ask you to click “Accept” to let it read your emails, access files or view contacts. This is a request for access to your account, rather than simply agreement to the app’s terms and conditions. 

A deceptive permission request may arrive through a phishing email or a link to an unfamiliar tool. This is often called OAuth consent phishing – tricking you into giving an app access to your account information without giving it your password. Whether you can approve this access depends on your organisation’s settings. 

How do rogue application attacks put your business at risk? 

Once a harmful app has permission to access your account, an attacker may be able to read emails, copy business files, or view contacts, depending on the permissions granted. 

That access can remain even after you change your password. Microsoft warns that a password reset or MFA alone does not remove the app’s permissions. Your IT team needs to investigate and remove unwanted access. 

This is a recognised threat. Huntress’s 2026 report found that OAuth abuse, misuse of the access applications have been given, accounted for 10.1% of identity-based attacks in its observed 2025 dataset.

How can you protect your business against rogue application attacks? 

• Pause before approving an app.  
• Ask whether IT has approved it and whether the requested permissions make sense. 
• Report an unfamiliar app or an unexpected permission request, especially if you have already accepted it. 

How does ITDR help detect rogue application attacks? 

ITDR helps spot apps that may be accessing your business information without a legitimate reason. Your IT team can then check the app and remove its access if needed. 

The video above shows how clicking “Accept” on an app’s permission request can give it access to your emails or files, without the attacker needing your password. 

5. Session hijacking

What is session hijacking?  

When you sign in, your browser or app stores a digital “pass” that keeps you logged in, so you do not have to enter your password every time you open your emails or files. 

Session hijacking happens when an attacker steals and uses that pass. This may let them access your account without entering your password or approving another Microsoft Authenticator request. 

A harmful program can get onto your device through an unexpected download or a fake software update. It can then steal the information that keeps you signed in and send it to the attacker. 

How is session hijacking different from AiTM? 

An AiTM attack uses a fake sign-in page to steal the digital “pass” that keeps you logged in. Session hijacking is when an attacker uses a stolen pass to access your account. The two can happen as part of the same attack

The session hijacking video above shows another way to steal that pass: through harmful software on your device. 

A Huntress investigation recorded an attacker using a stolen session just four minutes after the user reached the MFA prompt. During the wider campaign, attackers also added devices to accounts, changed sign-in security settings and created email rules to hide messages. 

How can you protect your business against session hijacking? 

• Keep devices and browsers updated through approved routes.  
• Use approved software and extensions. 
• Avoid running commands or installing a “fix” suggested by an unexpected website. 
• Report unusual activity even if your password and security details look unchanged. 

The session hijacking video shows how an attacker can use a stolen sign-in session. It also explains why protecting your device matters: harmful software on it could steal the access that keeps you logged in

How does ITDR help detect session hijacking? 

ITDR looks for signs that someone else may be using your account after you have signed in. For example, Huntress monitors changes during an active session that could suggest an attacker has taken over. Your IT team can then investigate and help secure the account

Why is MFA alone is no longer enough for Microsoft 365 security? 

The attacks above show how cybercriminals can misuse an employee’s identity to access their work account and reach business information. 

MFA, including Microsoft Authenticator, adds an extra security check when you sign in. But attackers may steal the digital “pass” that keeps you logged in after that check or trick you into giving a harmful app access to your emails and files. 

MFA remains essential, but it cannot stop every identity attack on its own. ITDR adds another layer of protection by looking for signs that someone is misusing your account, including after a successful sign–n. 

In simple terms: 

• MFA adds an extra check to help confirm who is signing in. 
• ITDR looks for signs of account misuse, including after sign-in. 

Together, MFA and ITDR help protect your Microsoft 365 accounts, but keeping devices updated and telling IT when something looks wrong is still important. 

What counts as a suspicious Microsoft 365 sign in? 

A suspicious sign-in is a login that does not fit what is expected for that account and needs checking. Warning signs can include: 

• An unfamiliar device. 
• A network associated with attackers. 
• A different browser than usual. 
• Changes in the browser or operating system during an existing sign-in session. 

An unexpected location alone does not prove a compromise. Travel, mobile networks and an approved VPN can all affect how a legitimate sign-in appears.  

ITDR helps assess the available signals together, rather than treating every difference as an attack. 

If you see a successful sign-in you cannot explain, or receive an MFA request you did not start, report it through your established IT support route. You do not need to diagnose the cause first. 

What should you do if you think your Microsoft 365 account has been hacked? 

• Contact your managed IT service provider through your established support route. 
• Use a known phone number if your mailbox may be compromised. 
• Explain what happened and when.  
• Keep the suspicious message or note the unexpected change, but do not delay reporting to collect evidence. 
• Do not approve unexpected MFA requests or share sign-in codes.  
• Tell your IT provider if you clicked a link, installed something or approved an app. 
• Let IT coordinate recovery.  

Microsoft’s guidance includes checking account access, active sign-in sessions, authentication methods and email rules. Changing a password alone may leave other access in place. 

You do not need to identify the attack or prove that your account is compromised before asking for help 

How can you review your Microsoft 365 security? 

For a quick three minute online review of your organisation’s setup, Ionic IT’s Microsoft 365 security assessment is a useful next step.

Your answers will provide you with an actionable report to improve your Microsoft 365 security. You can also book a more in-depth audit and review your results with Ionic’s IT Strategy Consultant to find out how ITDR could add an extra layer to your Microsoft 365 protection.

Disclaimer: Information provided for general informational purposes only.