Cyber Security
Suspicious activity in Microsoft 365? We see it and step in
We keep an eye on your Microsoft 365 environment for suspicious activity and step in if something is not right, partly fully automatically.
The problem
Your Microsoft 365 account is one of the most valuable targets for criminals. With one stolen password they can read your email, set up forwarding rules, intercept invoices and get to your files. The annoying part: this often goes unnoticed for a long time. The account works as normal, while someone is reading along in the background.
That is why we keep a constant eye on your Microsoft 365 environment. Suspicious activity is recognised and processed automatically as much as possible, so action is taken quickly. If something really is wrong, our engineers take it on.
What will you notice?
Usually nothing: it happens in the background. If we notice something suspicious, you will hear from us, and sometimes we ask you to quickly confirm whether a sign-in or action really was you or a colleague.
What it does for you
How Microsoft 365 monitoring helps you
- 01
Suspicious activity stands out
A sign-in from an unusual country, an unexpected forwarding rule or someone suddenly downloading lots of files: signals like these stand out, even if nobody is looking for them.
- 02
Fast, automatic action
Where possible, we process alerts automatically. This means action can be taken straight away, for example by blocking an account, before an attacker gets any further.
- 03
We handle it
If something really is wrong, we find out what happened, fix what is needed and keep you informed.
How it works
How we arrange it
Not a technical story, but what happens and who does what.
Plan an introduction- Step 1
Watching
We follow the activity in your Microsoft 365 environment, such as sign-in attempts, changes to settings and the sharing or downloading of files.
- Step 2
Detecting
Anomalies and known signs of an attack are recognised and turned into an alert.
- Step 3
Responding automatically
We process alerts and incidents as automatically as possible, so there is a quick response.
- Step 4
Resolving
Our engineers investigate what happened, take the necessary measures and contact you if needed.
Frequently asked questions
Questions about Microsoft 365 monitoring
Is your question not listed? Feel free to call us, we are happy to think along with you.
What is an IOC?
IOC stands for Indicator of Compromise: a sign that an account or system may have been hacked. Think of a sign-in from a place you never go to, or a rule that quietly forwards all your email to an unknown address.
Is this a separate product I have to buy?
No. It is part of Modern Workplace Standard, and we also monitor your other cloud applications. With Essentials you add it with the Cybersecurity package. For this we use, among other things, Cloud Detection & Response, so alerts and incidents are processed automatically.
What if it is a false alarm?
That can happen, for example if you sign in while on holiday. Then we quickly check it with you. Better to ask once too often than to have a break-in go unnoticed for weeks.
Further reading
Other solutions