How to Detect a Compromised Microsoft 365 Account with Nathan Ostrowski from Petra

Business email compromise is now the leading cause of cyber-related financial loss, and the signals most IT teams rely on to catch it no longer hold up. Host Nathan Taylor and Petra Security Co-founder and COO Nathan Ostrowski explain how residential proxies, phishing toolkits, and SEO phishing let attackers log in from your users’ own cities.

Not sure whether an attacker is already signed in to one of your Microsoft 365 accounts? Talk with the Sourcepass Center of Excellence for Microsoft about a free Microsoft 365 Identity Threat Assessment, powered by Petra. You’ll see which accounts are affected, how the attacker got in, how long they had access, and what they opened, forwarded, or deleted, along with prioritized recommendations for hardening your tenant. Take the Assessment here: https://go.fame.so/sourcepasspetra

They cover why location-based conditional access falls short, how behavioral identity threat detection and response (ITDR) catches Microsoft 365 account takeover in under a minute, and which tenant hardening steps reduce your exposure.

Nathan Ostrowski is the COO and Co-founder of Petra Security, which provides identity threat detection and response (ITDR) for Microsoft 365. Petra builds behavioral profiles for every user in a tenant by correlating sign-in, Exchange, SharePoint, and Teams activity. That lets it tell a legitimate user from an attacker, shut down account takeover as it happens, and produce detailed forensics after a compromise.

Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.

Business email compromise now tops the FBI’s list of costly cyberattacks. Nathan explains what identity threat detection and response (ITDR) covers, from account takeover and session theft to the fraud that follows.

Most identity attacks now come from inside the US, often from the user’s own city. Nathan explains why traditional SIEM rules miss them and how per-user behavioral profiles catch what sign-in location can’t.

Despite layered security tools and compliant-device enforcement, one CEO was compromised from a residential proxy in his small hometown. The attacker then registered a compliant device through a Microsoft Authentication Broker gap.

As you know, investigating a compromise through the Microsoft Entra ID portal is slow and error-prone. Petra’s forensic reports show how attackers got in, how long they stayed, and what they touched, often catching mailbox rules and devices a manual review missed.

Stolen sessions are bought and sold, and attackers often wait before acting. Petra sees about one compromise per 500 identities per month. If you aren’t seeing that rate, something may be going unnoticed.

Automated toolkits do their most valuable work in the first ten minutes. Correlating logins, mailbox rules, and new devices in real time can stop an attacker before sensitive financial data leaves the mailbox.

Nathan shares the changes with the biggest impact: disabling direct send, moving toward passkeys and compliant devices, and tightening SPF and DKIM. He also explains SEO phishing, which poisons “Microsoft password reset” search results.

Demystifying Microsoft is handcrafted by our friends over at: fame.so