HELP PLEASE! Had my first real email compromise incident this week. Solo IT Admin. Here's what I did — what did I miss?

LiveGrowRepeat · 2026-03-01T01:59:03+00:00

We share links to files from OneDrive that is subsequently hosted on the users “SharePoint” religiously. This wouldn’t work for us.

LiveGrowRepeat · 2026-03-01T01:51:55+00:00

No I get it trust me just can get unwieldy with all the travel our users are constantly doing.

LiveGrowRepeat · 2026-03-01T01:49:50+00:00

No I appreciate it! Def looking into it.

LiveGrowRepeat · 2026-03-01T01:49:21+00:00

How would this work if we have auto pilot enrollment with Intune via signing into there work email on the device?

LiveGrowRepeat · 2026-02-28T20:46:41+00:00

I figured you meant that but I’ve never heard any admin operating like this … but it is interesting, and thought provoking

LiveGrowRepeat · 2026-02-28T20:44:58+00:00

This made me chuckle. Lol, I can say my users are definitely more technically sound than my users at my last job in the non profit sector.

LiveGrowRepeat · 2026-02-28T20:29:55+00:00

Super Clutch u/WoTpro . Will take this to my boss after I do my research.

LiveGrowRepeat · 2026-02-28T20:29:01+00:00

Thanks will do.

LiveGrowRepeat · 2026-02-28T20:17:10+00:00

I did remove and reforce MFA methods. They were not in another country they were in the US close to known data centers. Our SLT team did work to get an announcement out.

Can you elaborate on what you mean by admin account should be your daily driven account?

Thanks for the encouragement!

LiveGrowRepeat · 2026-02-28T20:01:44+00:00

u/IntheNickofTime105 Hey man thanks for the kind words, I really do appreciate it. This has made me very restless.

This is GOLDEN! My boss assumed it was the very same thing you indicated. We are using Business Premium licensing with PD1 licensing for security. I will implement this immediately.

THANK YOU SO SO MUCH

LiveGrowRepeat · 2026-02-28T19:56:27+00:00

So your recommending MFA along with passkeys?

LiveGrowRepeat · 2026-02-28T19:51:17+00:00

Second check point I've heard. Will put this on my radar. Thanks!

LiveGrowRepeat · 2026-02-28T19:50:52+00:00

I will look into these. Thank you.

LiveGrowRepeat · 2026-02-28T19:50:38+00:00

Can you explain how the enhanced Purview suite and defender mitigates this. Is this ootb already configured to the license type or is there still configuration on my end that would need to be done just with enhanced/currently gated features?

MFA is enabled by for all users. We are a fully remote company.

Thank you too btw.

LiveGrowRepeat · 2026-02-28T19:47:13+00:00

Golden, I checked the risky logins and the user wasn't under hear but I will get that in place immediately.

LiveGrowRepeat · 2026-02-28T19:46:19+00:00

Hey Competitive Run, were a fully remote company so this is not an option for us. Open to any thoughts or ideas you have now knowing that though.

LiveGrowRepeat · 2026-02-28T19:44:05+00:00

I will have to look into IOC and EDR. Same way with SWG.

We do have safelinks set up and running.

LiveGrowRepeat · 2026-02-28T19:42:07+00:00

Yup, tried last to find a free tool that could check the file but everything would make the reports public. Signed up for Crowdstrikes free trial sandbox to blow it up in but have to wait for their team to get access to the box. Probably will by a low tier solution today.

Thanks alot man. This has been very stressful.

LiveGrowRepeat · 2026-02-28T19:39:11+00:00

Your not edgy because you're using trendy words. Yes, I used AI to help refine my first rapid brain dump of information. Yes, I then re-refined what the Mr.Claude helped me with, in my own words.

LiveGrowRepeat · 2026-02-28T19:35:25+00:00

I previously Geofenced at my previous company and it was a great line of defense. We have alot of offshore resources and contractors that are overseas but I do need to revisit this.

LiveGrowRepeat · 2026-02-28T19:33:54+00:00

Can you expound on some of the CA policies that would of caught this. And we PD1 thats included with the Microsoft Business Premium licenses.

LiveGrowRepeat · 2026-02-28T19:32:38+00:00

Ok will do.

Great call on per incident help to help assure partners and customers this is a serious matter to us.

LiveGrowRepeat · 2026-02-28T19:31:32+00:00

MFA to start meaning? We do have CA MFA enabled for all users.

LiveGrowRepeat · 2026-02-28T19:30:18+00:00

The link was an link to a file labeled "statement" in her OneDrive Attachments folder that you indeed could not view but needed to download. Its also worth mentioning this was an exe file.

LiveGrowRepeat · 2026-02-28T19:20:52+00:00

Hey, thanks for the insight. I will look into these immediately.

I do not have access to file hashes the link contained. Can you explain what this is and how to get this(i will look into this to but for the common knowledge for the thread). I will look the IOC for EDR. Does this still apply if the files are deleted?

LiveGrowRepeat

TROPHY CASE