Admin24 — Microsoft 365 security

The challenge

A phishing attempt targeted Admin24's shared mailbox. MFA was disabled on multiple accounts, external sharing in Microsoft 365 was wide open and unknown email forwarding rules were active. A single click on a phishing link could lead to account takeover and client data exfiltration.

Our approach

Korur enforced MFA on every account, set up conditional access policies based on location, device and risk, restricted external sharing to explicitly approved scenarios and audited every email forwarding rule. The complete Microsoft 365 baseline was aligned with Microsoft Secure Score recommendations.

The result

Account-takeover risk neutralised. Client data is now protected via conditional access. The Microsoft 365 baseline is in order and continuously monitored.

Technologies