---
title: "Checklist: Microsoft 365 identity and control-plane attacks"
description: The Microsoft 365 attack vector is changing. Modern attacks increasingly start with attackers targeting identities, authentication flows, OAuth applications, permissions, sessions and tenant configurations. This checklist explains the new ways attackers are exploiting Microsoft 365 environments, details which security controls reduce risk and reveals how Acronis Security Posture Management (SPM) helps managed service providers (MSPs) identify and remediate security gaps across client tenants.
canonical_url: https://www.acronis.com/en/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/
locale: en
last_updated: 2026-10-27
---

October 19, 2026

[eBooks](https://www.acronis.com/en/resource-center/category/ebooks/)
# Checklist: Microsoft 365 identity and control-plane attacks

Also available in:

[Deutsch](https://www.acronis.com/de/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/)  
[Español](https://www.acronis.com/es/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/)  
[Français](https://www.acronis.com/fr/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/)  
[Italiano](https://www.acronis.com/it/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/)  
[Português](https://www.acronis.com/pt/resource-center/resource/microsoft-365-identity-and-control-plane-attacks/)

[View this asset as a PDF](https://staticfiles.acronis.com/downloads/758c0ebfb7a7f5ea6f0a9717a82d3fa9 "View this asset as a PDF")

![Image 1: Checklist: Microsoft 365 identity and control-plane attacks](https://staticfiles.acronis.com/images/content/356ad4eda4c4215e62adc16d08b52a0c.png)

## Learn how to protect Microsoft 365 tenants from attacks that bypass endpoints

The Microsoft 365 attack vector is changing. Modern attacks increasingly start with attackers targeting identities, authentication flows, OAuth applications, permissions, sessions and tenant configurations.

This checklist explains the new ways attackers are exploiting Microsoft 365 environments, details which security controls reduce risk and reveals how Acronis Security Posture Management (SPM) helps managed service providers (MSPs) identify and remediate security gaps across client tenants.

### Consult this checklist to:

*   Learn about nine common attack techniques used in real-world Microsoft 365 compromises

*   Discover why identity-based attacks are growing in number and frequency

*   Find out how Acronis SPM helps MSPs reduce Microsoft 365 risk

Cyber Platform

for Service Providers

[Try Now](https://www.acronis.com/en/products/cloud/trial/?utm_webteam=nrc-banner)

[M365 Security & Protection](https://www.acronis.com/en/resource-center/tag/m365-security-protection/)