News & Research

Microsoft 365 connected apps security: what IT admins need to know Microsoft 365 connected apps security  is now a core admin priority because OAuth permissions can create standing access to mail, files, and directory data until app grants are reviewed and revoked. Yet most Microsoft 365 security conversations still orbit the same center of gravity: passwords, MFA, and user sign-ins. But attackers are quietly shifting one layer deeper—toward Microsoft 365 / Entra ID connected

A recently reported attack campaign highlights a growing weakness in how organizations think about identity security in Microsoft 365. According to a December 2025 report published by The Hacker News , threat actors linked to Russia have been abusing Microsoft 365 device code authentication  to gain access to accounts while bypassing traditional phishing defenses and MFA protections. Source: The Hacker News  — “Russia-Linked Hackers Use Microsoft 365 Device Code Phishing to B