The quiet way in
Halloween is full of disguises, but a cyberattacker does not need a costume to get inside a Microsoft 365 environment. A stolen password or malicious app consent can be enough. From there, the intruder may appear to be an ordinary user doing ordinary work. That is what makes identity compromise so unsettling: The front door can look perfectly familiar.
Phishing can trick users into sharing credentials or granting access. Attackers may also steal authenticated sessions, so a password reset alone may not stop access. Once inside, attackers can access mail and files, change permissions or security settings and maintain access while blending into everyday activity.
Identity is part of the recovery plan
Protecting that access starts with the identities and settings behind it. Microsoft Entra ID governs who can access Microsoft 365 and connected SaaS applications. Beyond user accounts, it manages roles, groups, app registrations, policies and the relationships that shape access. A compromised administrator can change those settings; an accidental deletion or faulty change can also lock people out or weaken protection.
Restoring a mailbox or SharePoint site may bring back its contents, but it will not necessarily restore the identity configuration that controls access. A recovery plan should account for users, groups, permissions, Conditional Access policies and application connections. It should also preserve the ability to investigate what happened and return to a known-good configuration.
What the research tells us
The Acronis Cyberthreats Report from the Acronis Threat Research Unit (TRU) points to the same pressure on people and collaboration tools. In H2 2025, phishing made up 83% of email threats, and advanced attacks in collaboration applications rose from 12% of attacks in 2024 to 31% in 2025. The report also found phishing was the leading initial access vector in 52% of attacks targeting managed service providers. These findings show why protection needs to follow work across email, Teams and cloud identities, not stop at the inbox.
The shared responsibility still applies
In an interview with Andy Kerr, Senior Solutions Marketing Manager at Acronis, he describes how the protection conversation has changed:
“The basic tenets remain the same: Zero trust and shared responsibility. Clients remain responsible for their own data and its protection, and in turn, their MSPs remain responsible for their clients’ data. The big change has been around identity and the need to address identity and its configuration layers alongside business data.”
Kerr’s point reinforces why protecting business data also means protecting the identities and configurations that govern access to it. That broader scope matters as attackers increasingly target identity itself, as he explains:
“There’s a lot more targeting of identity itself, which is the control plane of Microsoft 365. It also controls access: It’s the keys to the kingdom. It controls access to any business-critical SaaS app through single sign-on. Compromised accounts, stolen sessions, malicious applications and any misconfiguration or bad changes can leave it open to attack.”
He adds, “So, what does that mean for Acronis and our partners? The great news is that we can address that identity risk very easily through both security posture management and Entra ID backup. For partners, that expands the conversation from backing up and securing mailboxes against malware and threats to protecting identities and communications and ensuring employee uptime and productivity.”
The practical lesson is straightforward: Treat identity as business-critical infrastructure. Use least privilege and multifactor authentication, review application permissions, and monitor for unusual sign-ins or configuration changes. Give employees regular, realistic security awareness training so they can question unexpected requests without slowing down legitimate work.
Make recovery part of resilience
Prevention matters, but no single control makes compromise impossible. Security posture management can help identify risky settings before they are abused. Backing up Entra ID can help restore identities and their configurations after malicious changes, deletion or an operational mistake. Microsoft 365 backup protects the business data users need to keep working. Together, these capabilities help address both access and the information behind it.
For service providers, this also creates a more complete conversation with clients: how to reduce identity risk, how to respond if an account is compromised, and how to recover the policies and relationships that make the tenant usable. Recovery should be practiced before an incident, with clear ownership and a tested path back to normal operations.
A valid sign-in can be difficult to distinguish from trusted activity. Organizations can make it harder for attackers to hide by strengthening identity controls, helping users spot social engineering and preparing to recover the configuration that governs access. Acronis’s upcoming webinar on Microsoft 365 identity protection will explore Entra ID recovery, security awareness and infrastructure resilience.
Written by
About Acronis
Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.
