M365 Left of Boom: Do Not Ignore “Small” Weirdness

M365 LEFT OF BOOM: DO NOT IGNORE “SMALL” WEIRDNESS

There is a moment before every cybersecurity incident where the conditions are already in place.

The attacker has not wired money out yet. They have not taken over the inbox. They have not created persistence, escalated privileges, or started quietly reading sensitive emails. But the path is open.

That moment is ‘left of boom.’

In cybersecurity, “boom” is the bad day. It is the business email compromise. The account takeover. The fraudulent invoice. The executive impersonation. The unauthorized access to SharePoint, Teams, OneDrive, or email. The incident response scramble. The uncomfortable client notification. The downtime, legal review, insurance claim, and cleanup.

‘Left of boom’ is everything that happens before that.

Most Microsoft 365 attacks do not start with a dramatic break-in.

They start with something ordinary.

A login page that looks real.
A shared document from someone familiar.
A Teams message with urgency.
A vendor asking to update payment information.
A new app asking for permission to connect to your Microsoft account.
A mailbox rule no one remembers creating.
A former employee account that was never fully removed.
A user who has access to files they no longer need.

To an attacker, these are not small details. They are openings.

And once an attacker finds one, the bad day can move quickly. Business email compromise, account takeover, fraudulent payments, exposed files, unauthorized access, and long cleanup efforts often begin with a gap that could have been caught earlier.

That is why businesses need to think “left of boom.”

In plain English, that means stopping the attack before it becomes an incident. It means closing the doors attackers use most often before they get the chance to walk through them.

For Microsoft 365, that is not just an IT responsibility. It is a shared responsibility between your business, your employees, your leadership team, and your managed service provider.

Your MSP can configure, monitor, and secure the environment, but your team plays a critical role in spotting suspicious activity, communicating business changes, questioning unusual requests, and following security processes.

Attackers know that. Businesses need to know it too.

What Attackers Are Doing in Real Microsoft 365 Environments

Attackers are not always using complex, movie-style hacking techniques. In many cases, they are using normal Microsoft 365 features against the business.

They log in with stolen credentials. They trick users into approving access. They hide suspicious email activity with mailbox rules. They watch conversations. They wait for payment discussions. They impersonate executives, vendors, or employees. They look for files that are overshared. They take advantage of accounts that still have access after someone changes roles or leaves the company.

To the business, it may look like Microsoft 365 is working normally.

To the attacker, it is a goldmine.

The Client’s Role: What Your Team Needs to Watch For

Your MSP can put strong protections in place, but there are certain things only your team will see first.

Your employees know when a vendor request feels off.
Your finance team knows when payment instructions suddenly change.
Your managers know when an employee changes roles.
Your leadership team knows when an executive did not really send that urgent request.
Your users know when their inbox suddenly behaves strangely.
Your operations team knows when someone leaves the company and access needs to be removed.

That business context matters.

The fastest way to reduce Microsoft 365 risk (left of boom) is to pair strong technical controls with clear client-side communication.

Here are the most important areas where businesses can help shut down common attack paths.

1. Treat Unusual Login Prompts as a Warning Sign

Many Microsoft 365 attacks begin with fake login pages or unexpected authentication prompts.

An employee may receive what looks like a normal Microsoft sign-in request after clicking a shared file, voicemail notification, Teams link, or password reset message. The page may look convincing. The request may feel routine.

That is exactly what attackers are counting on.

Your team should pause before entering credentials, especially when the request comes from an unexpected email, link, QR code, attachment, or message.

Employees should tell Braver if they notice:

Unexpected Microsoft login prompts
Repeated MFA prompts they did not initiate
A login request after clicking an unusual link
A Microsoft page that looks slightly different than normal
A message saying their password is expiring unexpectedly
Any sign-in alert they do not recognize

Why this matters:

If an attacker gets into one account, they may be able to read email, access files, monitor conversations, or impersonate that person. Reporting suspicious login activity quickly can make the difference between a blocked attempt and a full account takeover.

2. Never Approve MFA Prompts You Did Not Start

Multifactor authentication is an important layer of protection, but users still need to know how to respond when something feels wrong.

If an employee receives an MFA prompt and they are not actively trying to sign in, they should not approve it. That prompt may mean someone else has the password and is trying to get in.

This is one of the simplest and most important habits your team can build.

Employees should tell Braver if they notice:

MFA prompts they did not request
Multiple MFA prompts in a row
A phone call, text, or app notification asking them to approve a login
A prompt that appears at an odd time or from an unfamiliar location
A sign-in notification after clicking a suspicious link

Why this matters:

Attackers often rely on urgency, confusion, or fatigue. If users are trained to deny unexpected MFA prompts and report them immediately, your MSP can investigate before the attacker gains access.

3. Be Careful When Apps Ask for Microsoft 365 Permissions

Not every attack starts with a password.

Sometimes, attackers trick users into granting permission to an app. That app may request access to email, files, contacts, calendars, or other Microsoft 365 data.

The danger is that the user may think they are simply connecting a helpful tool. In reality, they may be giving an outside application access to sensitive business information.

Employees should be cautious when an app asks to:

Read email
Send email
Access files
Read contacts
Access calendars
Stay signed in or maintain access
Connect to Microsoft 365 or Microsoft Graph
Act on the user’s behalf

Employees should tell Braver before approving apps they do not recognize or were not instructed to use.

Why this matters:

Changing a password does not always remove access granted to a third-party app. If a risky app is approved, it can create a longer-term access problem.

4. Report Inbox Changes That Feel Strange

Attackers often create mailbox rules after they compromise an account. These rules can hide emails, forward messages, delete alerts, or move important conversations out of sight.

The user may notice something feels off before anyone else does.

Employees should tell Braver if they notice:

Emails disappearing unexpectedly
Replies going to folders they do not use
Sent messages they did not send
New inbox rules they did not create
Missing password reset emails
Missing vendor or client replies
A sudden increase in undeliverable messages
People saying they received emails the user did not send
Messages marked as read when the user did not open them

Why this matters:

Mailbox rules are commonly used in business email compromise. If an attacker can hide replies and monitor conversations, they can wait for the right moment to send a fraudulent payment request or impersonate the user.

5. Question Payment Changes Every Time

Microsoft 365 compromise and business email compromise often lead to financial fraud.

Attackers may sit quietly in an inbox and wait for an invoice, wire transfer, payroll change, or vendor payment conversation. Then they insert themselves into the thread or send a convincing message from a compromised account.

The message may come from a real employee account. It may come from a real vendor account. It may reference a real invoice. That is what makes it dangerous.

Your team should verify payment changes through a second trusted method, especially when the request involves:

New banking details
Wire transfer changes
ACH changes
Payroll deposit changes
Urgent payment requests
Gift card requests
Vendor contact changes
Requests to keep the matter confidential
Pressure from someone claiming to be an executive

Do not verify using the phone number or email address in the suspicious message. Use a known, trusted contact method already on file.

Why this matters:

Once money is sent to a fraudulent account, recovery is difficult and not guaranteed. A simple verification process can prevent a very expensive incident.

6. Tell Braver When Employees Join, Leave, or Change Roles

Microsoft 365 security depends heavily on accurate access.

When someone joins the company, they need the right access. When someone changes roles, old access should be reviewed. When someone leaves, access needs to be removed quickly and completely.

Attackers love stale accounts and unnecessary permissions.

Clients should notify Braver when:

A new employee is starting
An employee is leaving
An employee changes departments
An employee changes job responsibilities
A temporary worker or contractor no longer needs access
A vendor or guest user should be removed
An employee needs access to a new mailbox, SharePoint site, Team, or application
A manager wants to review who has access to sensitive files

Why this matters:

Over time, people collect access they no longer need. That creates more exposure if their account is compromised. Keeping Braver informed helps keep permissions aligned with real business needs.

7. Keep File Sharing Intentional

Microsoft 365 makes it easy to collaborate, but easy sharing can become risky sharing.

SharePoint, Teams, and OneDrive often contain sensitive business information. If files are shared too broadly, externally, or with old guest users, attackers may gain access to more than they should.

Employees should pause before sharing sensitive files and tell Braver if they are unsure about:

Sharing files outside the company
Using “anyone with the link” access
Giving edit access instead of view-only access
Sharing folders instead of individual files
Adding external guests to Teams or SharePoint
Keeping vendor access open after a project ends
Storing sensitive files in personal OneDrive locations

Why this matters:

Many data exposure issues come from oversharing, not from a technical exploit. Your MSP can help set safe sharing policies, but users need to make thoughtful choices day to day.

8. Do Not Ignore “Small” Weirdness

A lot of cyber incidents start with a small clue.

An employee might say, “That was strange, but it’s probably nothing.” Unfortunately, that small detail may be the first visible sign of account compromise.

Employees should report anything unusual, including:

Unexpected password reset emails
Microsoft alerts they do not understand
A Teams message that seems out of character
A client asking why they sent a strange email
A vendor asking about a payment change
Missing emails
Unfamiliar folders
Login alerts from places they have not been
New apps connected to their account
Emails in sent items they did not write
A sudden flood of spam, bouncebacks, or MFA prompts

Why this matters:

Early reporting gives Braver more time to investigate, contain, and fix the issue before it spreads.

What Braver Handles Behind the Scenes

While your team focuses on awareness, communication, and safe business processes, Braver can help with the technical side of Microsoft 365 protection.

That may include:

Reviewing Microsoft 365 security settings
Blocking legacy authentication
Strengthening MFA requirements
Reviewing Conditional Access policies
Monitoring suspicious sign-ins
Auditing admin permissions
Reviewing mailbox forwarding and inbox rules
Restricting risky third-party app consent
Reviewing guest users and external sharing
Cleaning up stale accounts
Helping leadership and finance teams build safer approval workflows
Responding quickly when suspicious activity is reported

The best results happen when both sides are aligned.

Braver can secure the environment, but your team’s behavior and communication are part of the defense.

Reality: Security Starts Before the Bad Day

Bad defaults, over-privileged accounts, and misconfigurations can lead directly to business email compromise, account takeover, persistence, privilege escalation, data exposure, and financial fraud.

But many of the most common Microsoft 365 attack paths can be reduced before they become incidents.

That starts with shifting left.

For business leaders, that means creating a culture where employees are comfortable reporting suspicious activity quickly. It means making sure staff changes are communicated promptly. It means verifying payment changes outside of email. It means asking before approving unfamiliar apps. It means treating Microsoft 365 security as an everyday business responsibility, not just an IT setting.

Attackers are counting on confusion, speed, and silence.

Businesses can fight back with awareness, communication, and a strong MSP partner watching the technical side.

Braver helps businesses close Microsoft 365 attack paths before attackers can use them, so your team can work with more confidence and fewer open doors.

Braver Technology Solutions | WeMakeITWork@BraverTechnology.com
Boston 617.315.8515 | Taunton 508.824.2260 | Providence 401.484.7900