Why it matters
Attackers increasingly skip the device and go straight for the account. Phishing kits steal passwords and session tokens, letting attackers sign in as your staff, read email, create forwarding rules and send fake invoices from a trusted address.
MFA reduces that risk but doesn’t eliminate it. Managed ITDR from Huntress monitors Microsoft 365 sign-ins and account activity, and its SOC confirms and responds to suspicious behaviour around the clock.
“MFA stops most attacks at the door. ITDR catches the ones that still get in.”
What’s included
- Sign-in monitoring
- Detection of suspicious sign-ins, impossible travel, unusual locations and risky VPN or hosting providers.
- Session theft
- Detection of stolen session tokens used to bypass MFA.
- Inbox rules
- Alerts on malicious forwarding, deletion and hiding rules — a classic business email compromise sign.
- Rogue apps
- Detection of suspicious OAuth applications granted access to your tenant.
- Response
- SOC-led response such as disabling the account and revoking sessions, followed up by our team.
Delivered with our partner Huntress and managed by our team.
From setup to ongoing management
- Step 1 · Connect
- Huntress is connected to your Microsoft 365 tenant with the required permissions.
- Step 2 · Review
- Existing inbox rules, apps and risky sign-ins checked for signs of prior compromise.
- Step 3 · Monitor
- 24/7 monitoring of identity activity by the Huntress SOC.
- Step 4 · Respond
- Compromised accounts contained, sessions revoked and credentials reset.
- Step 5 · Harden
- Lessons fed back into conditional access and MFA policies.
Frameworks it supports
This service contributes to the requirements of several frameworks. Coverage depends on your environment, so we confirm it during a gap review.
- ASD Essentials
- Identity services domain, anomalous authentication detection, and incident response covering token and session revocation.
- CIS v8.1
- Control 5 (account management) and Control 6 (access control management).
- ISO 27001
- Annex A 5.15 (access control), 8.5 (secure authentication) and 8.16 (monitoring activities).
Frequently asked questions
We already have MFA. Do we need identity protection?
MFA is essential, but attackers can bypass it by stealing session tokens or tricking users into approving prompts. Identity protection, powered by Huntress Managed ITDR, detects what happens after a successful sign-in.
Does it work with our existing Microsoft 365 licences?
Yes. Huntress ITDR connects to Microsoft 365 and adds its own detection and SOC response on top of your existing licensing.
What counts as suspicious activity?
Examples include sign-ins from unusual locations or hosting providers, new inbox forwarding or deletion rules, and unexpected app consent grants.