Notifications
Clear all
Topic starter
27/06/2026 1:50 pm
TL;DR: Attackers abused Microsoft Entra ID tenant branding to send phishing emails from legitimate Microsoft infrastructure that passed SPF, DKIM, and DMARC, with analysis of 2,000 messages across 250-plus abused tenants showing a scripted burn-and-churn campaign, according to Abnormal AI. The real risk is not spoofing, but trust being encoded into platform-generated identity notifications.
NHIMG editorial — based on content published by Abnormal AI: Microsoft Entra tenant branding abuse turns trust into phishing
By the numbers:
- Analysis of 2,000 messages across 250+ abused tenants revealed a scripted burn-and-churn operation using disposable Microsoft 365 free-trial tenants.
Questions worth separating out
Q: How should security teams detect phishing that comes from legitimate Microsoft identity workflows?
A: They should stop relying on sender reputation alone and inspect the notification context, body language, and tenant metadata that shaped the message.
Q: Why do allowlists make Microsoft identity notifications easier to abuse?
A: Allowlists are built to preserve delivery of trusted security messages, but attackers exploit that trust by making malicious content arrive through the same path.
Q: What breaks when tenant branding is not governed as a security control?
A: The organisation loses visibility into a field that can alter the text of security notifications seen by end users.
Practitioner guidance
- Inventory tenant fields that influence outbound identity messages Identify every Entra ID or Microsoft 365 field that can appear in automated security notifications, then classify it as security-relevant configuration.
- Replace sender-only trust with content-aware detection Build detections for financial pressure language, support-desk call-back numbers, and Unicode lookalike characters inside identity notifications.
- Review allowlists that exempt Microsoft verification mail Test whether inbox rules that exempt [email protected] create blind spots for abuse of Security Info or MFA workflows.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step breakdown of the Security Info workflow abuse that forces Microsoft to generate the message
- Examples of tenant-name payload construction, including the subject-line hijack pattern and Unicode obfuscation
- Message samples showing how Microsoft’s legitimate verification templates render the attack in the inbox
- Defender guidance on how Abnormal AI correlates platform context, recipient behaviour, and notification anomalies
👉 Read Abnormal AI's analysis of Microsoft Entra tenant branding abuse →
Entra tenant branding abuse: what IAM teams need to know?
Explore further
27/06/2026 3:20 pm
Platform-generated identity messages have become an attack surface, not a trust anchor. This campaign works because organisations still treat Microsoft-originated identity notifications as inherently trustworthy when they are only platform-authenticated. That assumption is too weak for tenant-configurable workflows, where attacker-controlled metadata can shape the final message content. Practitioners need to recognise notification governance as part of identity security, not just email hygiene.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How should IAM teams respond when a trusted platform can deliver malicious messages?
A: They should separate transport trust from content trust and review notification workflows as part of identity governance. That includes change control for message templates, monitoring for disposable tenant activity, and content analysis for social engineering cues. The goal is to reduce blind trust in system-generated identity mail.
👉 Read our full editorial: Microsoft Entra tenant branding abuse turns trust into phishing
