3.2. Respond to Email, Identity, and Cloud App Threats
💡 First Principle: Most intrusions begin with a message or a credential, not an exploit. Email delivers the lure, identity is what the lure steals, and cloud apps are where a stolen identity is used. Responding well means acting in the product that owns each piece: purge the email in Defender for Office 365, contain the identity in Entra ID and Defender for Identity, and cut off the app access in Defender for Cloud Apps.
Why care: business email compromise, adversary-in-the-middle token theft, and malicious OAuth apps cause some of the costliest breaches, and none is solved by isolating a laptop. Exam scenarios in this area test whether you can map each symptom to its owning product and pick the action that actually removes attacker access, such as revoking sessions after a token theft, where a password reset alone isn't enough.
Use a signal-source map to keep the products straight:
| Symptom | Owning product | Typical response |
|---|---|---|
| Phishing or malware email delivered to many users | Defender for Office 365 | Threat Explorer remediation, block in Tenant Allow/Block List |
| Risky cloud sign-in, leaked credentials | Microsoft Entra ID Protection | Confirm compromised, reset password, revoke sessions |
| Kerberoasting, pass-the-hash, DCSync on-premises | Defender for Identity | Disable user in AD, reset password, contain devices |
| Suspicious inbox rule, mass download, risky OAuth app | Defender for Cloud Apps | Suspend user, require sign-in again, revoke or ban the app |
| Sensitive data exfiltration or risky insider behavior | Microsoft Purview (DLP, Insider Risk Management) | Investigate activity, coordinate with policy owners, contain the account |
⚠️ Common Misconception: "Deleting the phish from the reporting user's mailbox remediates the campaign." Campaigns reach many recipients; you must find and remediate every delivered copy and block the source. Another trap: assuming Defender for Identity detects attacks on cloud-only Entra accounts. It watches on-premises Active Directory through its sensors; cloud sign-in risk comes from Entra ID Protection.
