From Inbox to SharePoint: Catching Attackers Mid-Collection in Microsoft 365
By the time an attacker is exfiltrating data from Microsoft 365, traditional controls are often too late to stop the damage—but “collection” activity leaves high-signal traces if you know where to look. In this discussion, Microsoft Senior Security Engineer Ryan O’Donnell explains the post-compromise collection workflow in Microsoft 365 and why mailbox and SharePoint/OneDrive search make ideal tripwire points.
O’Donnell illustrates how to design credible canary lures in Outlook and SharePoint/OneDrive that attackers are likely to touch but normal users will ignore, and how to use native audit telemetry to reliably detect those touches while filtering out service-generated noise. Security teams will learn how to build a repeatable Alert → Pivot → Scope workflow that ties canary hits back to identity context for fast triage, and how to tune and baseline canaries in noisy production environments without drowning in false positives.
Microsoft Entra Conditional Access sits at the front line of identity security—but as features multiply, so do subtle misconfigurations. Brandon Colley, TrustedSec Senior Security Consultant, highlights real-world lessons from engagements where attackers abused Conditional Access logic flaws, weak conditions, and incomplete MFA coverage to slip past defenses.
Through live demos, Microsoft MVP Christopher Brumm shows how you can implement granular access controls, privileged identity management, and access packages for partners and consultants, while maintaining high security standards.
In this HIP Conf session, Tim Wolf, Senior Solution Architect at Semperis, discusses the challenges of traditional PAW implementations and explores how modern PAW approaches offer greater flexibility and easier management while maintaining Zero Trust principles.