What are the signs that an Azure account takeover campaign is still active inside an organisation?

Signs include repeated logins from unusual devices or user agents, access to Microsoft 365 services the user does not normally use, and the sudden creation of MFA methods or mailbox rules. Another warning signal is phishing activity that spreads laterally from a compromised mailbox to other employees. These patterns indicate the attacker is maintaining access, not just stealing credentials once.

How to tell the campaign is still active, not just a one-time compromise

When an Azure account takeover campaign is still active, the attacker keeps re-entering the environment through fresh sessions, new devices, or newly created persistence. The key question is whether you are seeing a single stolen credential event or an ongoing access pattern that continues to expand, blend in, and re-establish control after detection or password changes.

Signals become more convincing when they cluster across identity, mailbox, and tenant activity. One login anomaly by itself may be noisy, but repeated authentication from unfamiliar geographies, user agents, or device fingerprints, combined with unusual Microsoft 365 service access, suggests the actor is still testing and maintaining access rather than exiting after the initial intrusion.

What persistence looks like in Microsoft 365 and Entra ID

Active campaigns often leave behind persistence mechanisms that survive the original stolen password. Sudden creation of MFA methods, addition of alternate recovery routes, mailbox forwarding or inbox rules, and changes to conditional access or app consent state can all indicate the attacker is preserving a foothold. A useful comparator is a broader view of Active Directory and Entra ID Hardening Guide, which helps frame where persistence and privilege usually accumulate.

Mailbox-centric persistence is especially important because compromise often shifts from account access to internal abuse. If the mailbox begins sending phishing messages to coworkers, or if new rules hide replies, delete alerts, or auto-forward content, that usually means the account is being used operationally. At that point, the issue is no longer only credential theft, but active abuse of the user’s trusted position inside the tenant.

Which signs matter most for triage and containment

The highest-value signals are the ones that prove repeated control, not just initial entry. Recurrent sign-ins from the same suspicious infrastructure, newly registered MFA factors, new OAuth or mailbox permissions, and lateral phishing from the compromised mailbox deserve priority because they show the attacker is adapting. For environment-wide context, the Identity Security Posture Management (ISPM) Guide is useful for turning these scattered indicators into a repeatable review of identity drift and standing exposure.

Another strong indicator is whether the account keeps touching services the user does not normally use, such as admin portals, message export features, or unfamiliar cloud apps. That pattern often means the attacker is mapping what they can reach and whether their access still works. If the activity continues after a password reset, the organisation should assume some other persistent path remains and investigate it as a live incident.

Risk and Threat Considerations

Active account takeover campaigns are dangerous because they can look like ordinary sign-in noise while the attacker is still expanding access, altering recovery paths, and using the mailbox as a trusted launch point. The real risk is not the stolen password alone, but the attacker’s ability to convert one successful login into durable presence across identity and messaging controls.

Failure mechanism: Persistence is maintained through added MFA methods, forwarding rules, consented access, token reuse, or repeated reauthentication from new devices and sessions, which allows the attacker to remain inside after the first compromise is noticed.

Impact: Continued presence increases the chance of mailbox abuse, internal phishing, privilege escalation, business email compromise, and broader tenant compromise before defenders fully remove the attacker.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Improper Offboarding	Active takeover persists when attacker access is not fully removed.
	NHI-02 — Secret Leakage	Stolen credentials and tokens are the entry path for ongoing takeover activity.
	NHI-05 — Overprivileged NHI	Excess permissions let an attacker expand from one account into broader tenant abuse.
Recommendation — Revoke all surviving access paths and rotate affected secrets before restoring the account. Treat exposed credentials as compromised and rotate them immediately. Reduce excessive permissions to shrink the blast radius of a compromised identity.
MITRE ATT&CK	T1078 — Valid Accounts	Repeated legitimate logins are a classic sign of living-off-the-land account abuse.
	T1114 — Email Collection	Mailbox access and forwarding rules support attacker persistence and internal phishing.
	T1136 — Create Account	Sudden addition of MFA or recovery methods reflects new persistence mechanisms.
Recommendation — Hunt for valid-account abuse across sign-ins, service access, and persistence changes. Monitor mailbox rules and forwarding changes for signs of adversary-controlled email access. Investigate new account or recovery artifacts as potential attacker persistence.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Credential and MFA changes are central to stopping continued account abuse.
	AU-6 — Audit Record Review, Analysis, and Reporting	Repeated sign-in and mailbox anomalies must be correlated to prove the campaign is active.
	AC-6 — Least Privilege	Limiting the account's reach reduces the damage from continued attacker access.
Recommendation — Rotate compromised authenticators and remove unknown factors without delay. Correlate sign-in, mailbox, and admin logs to confirm ongoing adversary activity. Remove unnecessary access to cut off lateral abuse from the compromised account.

Practitioner Guidance

What to verify: Do not treat a single password reset as closure. Confirm whether the account has any new MFA factors, forwarding rules, delegated permissions, app consents, or recent sign-ins that predate the reset, because those are the mechanisms that usually keep the campaign alive.

Decision rule: If the same user account continues to generate suspicious sign-ins or sends internal phishing after containment, treat it as an active foothold and escalate to full identity and mailbox containment rather than narrow credential remediation.

Practitioner takeaway: The campaign is still active when the attacker can keep re-entering, re-persisting, or using the account as a trusted internal launchpad, even if the original password has already been changed.