Defence Mapping & Hardening

⚔ Full Attack Chain Defence Coverage

Every major technique from Phases 1–8 mapped to its defensive control, detection method, and the Microsoft product required to implement it.

🔴 Critical — Implement Immediately

These controls address the most impactful attack techniques. Without them, an attacker can likely compromise admin accounts and maintain persistent access.

• Enable phishing-resistant MFA (FIDO2 security keys or Windows Hello for Business) for all administrator accounts and privileged roles
• Block legacy authentication protocols (IMAP, POP3, SMTP Auth, EWS Basic Auth) via Conditional Access for all users
• Block device code authentication flow via Conditional Access policy (or restrict to compliant devices only)
• Require admin consent workflow for all application registrations and consent grants — block user consent entirely
• Disable the ability for non-admin users to register applications (Entra ID > User Settings > App registrations > No)
• Restrict guest user invitations to specific admin roles only (Entra ID > External Identities > External collaboration settings)
• Enable Continuous Access Evaluation (CAE) to ensure near-real-time token revocation on policy or risk changes
• Deploy monitoring and immediate alerting on federation configuration changes (Set domain authentication, Set federation settings)
• Restrict eDiscovery role membership using Privileged Identity Management (PIM) with multi-party approval requirement

🟠 High Priority — Implement Within 30 Days

These controls significantly reduce the attack surface and should be prioritised after critical items are addressed.

• Enable Microsoft Entra ID Protection with risk-based Conditional Access policies (block or require MFA on high-risk sign-ins and users)
• Configure custom banned password list with organisation-specific terms, and ensure the Microsoft global banned list is enabled
• Block external email auto-forwarding at the Exchange Online transport rule level for all mailboxes
• Conduct a quarterly review of all application permissions — revoke unused or overly broad permissions (Mail.ReadWrite, Files.ReadWrite.All, etc.)
• Enable Privileged Identity Management (PIM) for all admin roles with approval requirements, time-limited activation, and justification
• Deploy Conditional Access policies covering all client application types, all device platforms, and all cloud apps (avoid leaving gaps)
• Monitor service principal credential changes by streaming audit logs to Sentinel and creating alerts on “Add service principal credentials”
• Enable sign-in and audit log streaming to a SIEM (Microsoft Sentinel, Splunk, or equivalent) with at least 90 days retention
• Enable token protection (token binding) in Conditional Access for supported clients to prevent token theft and replay
• Configure Power Platform DLP policies to restrict connector usage — block HTTP, SMTP, and other external connectors for non-admin users

🟡 Medium Priority — Implement Within 90 Days

These controls provide defence-in-depth and mature your security posture against more advanced or niche attack techniques.

• Restrict SharePoint Online external sharing to specific approved domains only; disable “Anyone” link sharing
• Conduct quarterly access reviews for all privileged roles using Entra ID Access Reviews with auto-remediation
• Enable Microsoft Purview sensitivity labels and DLP policies for sensitive data in Exchange, SharePoint, Teams, and OneDrive
• Restrict Power Automate connector usage via Data Loss Prevention policies — categorise connectors into Business/Non-Business/Blocked
• Audit inbox rules across the entire organisation — identify and remediate rules with external forwarding, DeleteMessage, or MoveToFolder actions
• Implement break-glass account monitoring: alert on any sign-in from emergency access accounts; ensure they are excluded from CA but heavily audited
• Restrict Teams external and guest access to approved federated domains only; disable anonymous meeting join
• Configure cross-tenant access settings to restrict inbound and outbound B2B collaboration to approved partner tenants
• Review and restrict user default permissions in Entra ID — disable “Users can read other users” if operationally feasible

💥 Detect Password Spraying

Identifies potential password spray attacks by detecting a single IP address generating failed sign-in attempts across multiple distinct user accounts within a short time window.

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == "50126"  // Invalid username or password
    or ResultType == "50053"   // Account locked
    or ResultType == "50057"   // Account disabled
| summarize
    TargetCount = dcount(UserPrincipalName),
    AttemptCount = count(),
    TargetAccounts = make_set(UserPrincipalName, 25),
    AppList = make_set(AppDisplayName, 10)
    by IPAddress, Location = tostring(LocationDetails.city)
| where TargetCount >= 10 and AttemptCount >= 20
| sort by TargetCount desc
| project
    IPAddress,
    Location,
    DistinctTargets = TargetCount,
    TotalAttempts = AttemptCount,
    SampleAccounts = TargetAccounts,
    AppsTargeted = AppList

📱 Detect Suspicious Application Consent

Monitors for new OAuth consent grants, especially those granting high-privilege permissions. This detects both illicit consent grant attacks and overly broad admin consent.

AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has "Consent to application"
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingIP = tostring(InitiatedBy.user.ipAddress)
| extend AppName = tostring(TargetResources[0].displayName)
| extend AppId = tostring(TargetResources[0].id)
| extend ConsentType = tostring(
    parse_json(tostring(
        parse_json(tostring(TargetResources[0].modifiedProperties))[0]
    )).newValue)
| project
    TimeGenerated,
    InitiatingUser,
    InitiatingIP,
    AppName,
    AppId,
    ConsentType,
    OperationName,
    Result
| sort by TimeGenerated desc

🏛 Detect Federation Configuration Changes

Alerts on any modification to domain federation settings. This is a critical detection because federation backdoors allow an attacker to generate tokens for any user without needing their password.

AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any (
    "Set domain authentication",
    "Set federation settings on domain",
    "Set DomainFederationSettings",
    "Add unverified domain",
    "Verify domain"
)
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| extend InitiatingIP = tostring(InitiatedBy.user.ipAddress)
| extend TargetDomain = tostring(TargetResources[0].displayName)
| extend ModifiedProps = parse_json(tostring(TargetResources[0].modifiedProperties))
| project
    TimeGenerated,
    OperationName,
    InitiatingUser,
    InitiatingApp,
    InitiatingIP,
    TargetDomain,
    ModifiedProps,
    Result
| sort by TimeGenerated desc

📨 Detect Mailbox Forwarding Rules

Detects creation of inbox rules that forward, redirect, or delete mail — common persistence and exfiltration mechanisms used after mailbox compromise.

OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Enable-InboxRule")
    or (Operation == "Set-Mailbox" and Parameters has_any (
        "ForwardingSmtpAddress", "ForwardingAddress", "DeliverToMailboxAndForward"
    ))
| extend RuleParams = parse_json(Parameters)
| extend ForwardTo = tostring(RuleParams.[0].Value)
| extend RuleName = tostring(RuleParams.[1].Value)
| project
    TimeGenerated,
    Operation,
    UserId,
    ClientIP,
    RuleName,
    ForwardTo,
    Parameters
| sort by TimeGenerated desc

// Also check for transport-level forwarding
union (
ExchangeAdmin
| where TimeGenerated > ago(24h)
| where Operation has_any ("New-TransportRule", "Set-TransportRule")
| where Parameters has_any ("RedirectMessageTo", "BlindCopyTo", "CopyTo")
| project TimeGenerated, Operation, UserId, Parameters
)

📂 Detect Bulk Data Access via Graph API

Identifies applications or users making an unusually high volume of Microsoft Graph API requests to mail, files, or user data endpoints — indicative of data exfiltration or automated harvesting.

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(1h)
| where RequestUri has_any ("/messages", "/driveItem", "/drive/root",
    "/sites", "/mailFolders", "/attachments")
| summarize
    RequestCount = count(),
    UniqueEndpoints = dcount(RequestUri),
    SampleRequests = make_set(RequestUri, 10)
    by UserId = tostring(UserId), AppId, IPAddress
| where RequestCount > 500
| sort by RequestCount desc
| project
    UserId,
    AppId,
    IPAddress,
    TotalRequests = RequestCount,
    UniqueEndpoints,
    SampleRequests

// Alternative if MicrosoftGraphActivityLogs not available:
// Use CloudAppEvents from Defender for Cloud Apps
// CloudAppEvents
// | where ActionType has_any ("FileDownloaded", "FileAccessed")
// | summarize count() by AccountId, Application
// | where count_ > 100

🔑 Detect Service Principal Credential Addition

Monitors for new credentials (passwords or certificates) being added to existing service principals or application registrations. This is a key privilege escalation and persistence technique.

AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in (
    "Add service principal credentials",
    "Update application \u2013 Certificates and secrets management",
    "Add application key credential",
    "Add application password credential"
)
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| extend InitiatingIP = tostring(InitiatedBy.user.ipAddress)
| extend TargetApp = tostring(TargetResources[0].displayName)
| extend TargetAppId = tostring(TargetResources[0].id)
| extend TargetAppType = tostring(TargetResources[0].type)
| extend ModifiedProps = parse_json(tostring(TargetResources[0].modifiedProperties))
| project
    TimeGenerated,
    OperationName,
    InitiatingUser,
    InitiatingApp,
    InitiatingIP,
    TargetApp,
    TargetAppId,
    TargetAppType,
    ModifiedProps,
    Result
| sort by TimeGenerated desc

📦 Microsoft 365 E3

The baseline licence for most enterprise organisations. Provides foundational security controls but lacks advanced threat detection and response capabilities.

🚀 Microsoft 365 E5

The full security stack. Includes everything in E3 plus advanced threat protection, identity protection, information governance, and compliance tools.

🔐 Entra ID P1 vs P2 Comparison

Understanding the differences between Entra ID P1 (included in E3) and P2 (included in E5) is critical for security control planning.

📊 Microsoft Sentinel (SIEM/SOAR)

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that enables centralised detection, investigation, and automated response. All KQL detection rules in Section 3 are designed for Sentinel.

// Verify your Sentinel data connector status
// Run this in your Log Analytics workspace
SigninLogs | take 1 | project TimeGenerated
AuditLogs | take 1 | project TimeGenerated
OfficeActivity | take 1 | project TimeGenerated

🛡 Defender for Office 365

Provides the anti-phishing, safe links, and safe attachments capabilities essential for defending against Phase 2 initial access techniques.

📝 Licensing Recommendation Summary

Based on the attack chain coverage in this guide, here is the minimum recommended licensing for effective defence:

MINIMUM VIABLE SECURITY LICENSING FOR M365 DEFENCE
====================================================

ALL USERS:
  - Microsoft 365 E3 (baseline) or E5 (recommended)
  - Entra ID P2 (included in E5, or add-on for E3)
    Required for: PIM, Identity Protection, Access Reviews

ADMIN / PRIVILEGED USERS (at minimum):
  - Microsoft 365 E5 Security add-on (if org is on E3)
    Required for: Defender for Cloud Apps, advanced audit

SECURITY OPERATIONS:
  - Microsoft Sentinel (consumption-based)
    Required for: KQL detection rules, SOAR playbooks
  - Defender for Office 365 Plan 2 (included in E5)
    Required for: anti-phishing, Safe Links, investigation

OPTIONAL BUT RECOMMENDED:
  - Defender External Attack Surface Management
    Required for: Phase 1 recon surface reduction
  - Entra Workload Identities Premium
    Required for: service principal risk detection