Microsoft 365Entra IDDefender XDRSentinelPurview
From attack to detection
Attacks against Microsoft 365 and Entra ID, how to investigate them and how to harden a tenant.
I'm Olivier, security architect at Wakers. This blog starts from the attacks I see against Microsoft 365 and Entra ID: how they work, how to investigate them and how to harden a tenant against them.
Available now
REFERENCE · UPDATED 2026
Microsoft 365 & Entra ID attack matrix
The attacker's view of a tenant, mapped by tactic: password spray, AiTM, device code phishing, OAuth backdoors, BEC, GoldenSAML, AI agents...
FundamentalsMicrosoft 365, Azure and Entra ID: what sets them apart and where the security tools are.
Coming next
IN PROGRESS
InvestigateOne article per technique of the matrix: which logs you need, how to follow the attacker, how to contain. Starting with log sources, BEC and token theft.IN PROGRESS
HardenArchitecture and design choices: Conditional Access, privileged accounts, protection of MFA and device registration.PLANNED
DetectSentinel and Defender XDR: detection coverage measured against the matrix.PLANNED
ComplianceNIS2 and DORA mapped to Microsoft controls.Older side projects (DMARC, PowerShell, Sysinternals, mobile forensics) are kept here.
Disclaimer
Some articles describe attacker techniques. Reproduce them only in a lab you own.