Microsoft 365 misconfigs tied to breaches

- Identity compromise and misconfiguration keep driving cloud breaches: misshared Microsoft 365 files and unauthenticated access account for roughly one third of observed incidents. - Analysts warn MFA/OAuth persistence can survive account resets, letting adversaries retain access via OAuth tokens or trusted devices unless enumerated and revoked. - Ridgeline Cyber published KQL playbooks for M365 compromise sequencing and SANS is offering CLI hunting sessions to find persistence artifacts. (x.com) (x.com)