Detecting and stopping AI-powered attacks: what works in Microsoft 365

Attackers use AI the way other businesses do: to get routine work done faster and more cheaply. For defenders, the technology behind it matters less than two questions: which familiar warning signs disappear, and which controls still hold. Our article AI and cybersecurity in Microsoft environments covers Security Copilot and the rollout of Microsoft 365 Copilot. This one looks at the attacker’s side and at the measures in Entra ID and Defender that counter it.

What changes on the attacker’s side?

Flawless phishing at scale. Language models write emails in clean German or English, in the tone of your industry and with references to real projects, suppliers or people taken from public sources. What used to be manual work for a handful of targets can now be tailored individually for hundreds of recipients. Spelling mistakes and clumsy wording are no longer a reliable warning sign.

Fake voices and video. Interviews, webinars or voice messages provide enough material to imitate a voice convincingly. Two processes are particularly exposed: the call from supposed management demanding an urgent transfer, and the call to the help desk in which a supposed employee asks for a new password or a new MFA method.

Faster reconnaissance and exploitation. Attackers analyse publicly reachable systems, organisation charts and leaked credentials automatically. The time between first access and misuse of an account gets shorter. If alerts are only reviewed on the next working day, the response is more often too late.

Phishing kits that bypass MFA. Ready-made adversary-in-the-middle kits place a fake page between the user and the Microsoft sign-in. The user enters password and code, the page relays both and receives the session token. With that token, the attacker carries on without having to complete MFA again. AI makes the preceding email more convincing; the technique itself has been around for some time. The recording of our webinar at the end of this article (in German) shows three such attacks on Microsoft 365 and what stops them.

Attacks on your own AI tools. Where staff use Copilot or AI agents, instructions hidden in documents or web pages can make the tool take actions nobody asked for. What Defender for Endpoint does about this is covered in Detecting and blocking prompt injection in local AI agents.

Why is looking closely no longer enough?

Training remains useful, but it loses its main support: the fake no longer looks fake. An email without errors, a voice that sounds like the managing director, a sign-in page identical to the real one down to the pixel. A defence that relies on someone hesitating at the right moment gets weaker with every improvement in the tools.

That is why defence changes less than the attacks do. What works are controls that hold even when someone falls for the deception: a sign-in that technically fails on a fake page, a token that is worthless on another device, and a payment that is not released without a call-back to a known number.

Which measures have the greatest effect?

The five measures below are ordered by effect. The first three prevent damage even when the deception succeeds; the last two shorten the time to detection.

1. Enforce phishing-resistant sign-in

Passkeys, Windows Hello for Business and certificate-based authentication are bound to the genuine sign-in address. They do not work on a copied page, and there is no code to relay. In Conditional Access you require this through the “Phishing-resistant MFA” authentication strength, which needs Entra ID P1. Start with administrators and emergency access accounts; that can be done within a few weeks. For all staff, plan for several months, because devices, shift workstations and communication have to be prepared in waves. The sequence is described in Conditional Access and passkeys.

2. Bind sessions to managed devices

A stolen token is only valuable if it can be used elsewhere. In Conditional Access, require a compliant or Entra-joined device for access to company data. Token Protection, a Conditional Access session control, accepts only tokens bound to the issuing device for Exchange Online, SharePoint Online and Teams. It is generally available for native applications; support for browser applications is a preview with a narrow scope (as of October 2026). Start in report-only mode with a pilot group. Also block the device code flow wherever it is not needed, because it can be misused for phishing.

3. Define call-back procedures for payments and the help desk

Against cloned voices, a fixed procedure helps most. No payment and no change of bank details based solely on an email, a call or a voice message. Four-eyes approval and a call-back to a number from your own master data apply. The same goes for the help desk: no password or MFA reset just because the voice on the phone sounds familiar. A Temporary Access Pass is only issued after identity verification through a second channel. To take load off the help desk, you can use account recovery in Entra ID: employees verify themselves with a government-issued ID and a live match through Verified ID Face Check, and then receive a Temporary Access Pass. This requires Entra ID P1, a Face Check licence and an identity verification provider. The procedure itself can be agreed and trained within a few weeks.

4. Configure Defender for Office 365 beyond the defaults

Impersonation protection in the anti-phishing policies detects emails posing as your management, your finance team or an important partner, including those from look-alike domains. The default policy does not cover your people and domains until you add them. Add the exposed senders and set the action to quarantine. Safe Links also checks links at the moment of the click. That helps against pages that are only activated after the email has been delivered. Both are part of Defender for Office 365 Plan 1, which is included in Microsoft 365 Business Premium and, since 1 July 2026, in Microsoft 365 E3. Details are in getting Defender for Office 365 right.

5. Correlate signals and have someone watch them

A single signal is rarely conclusive. Defender XDR links indicators from identity, email, endpoints and cloud apps into one incident. When it detects adversary-in-the-middle attacks, automatic attack disruption can disable or contain affected accounts, provided Defender for Identity, Defender for Office 365 and Defender for Cloud Apps are in place. Entra ID Protection assesses the risk of sign-ins and users. Risk-based Conditional Access policies (Entra ID P2) let you require a secure password change or block access when risk is high. None of this helps unless someone also reviews alerts at night and at weekends.

Further building blocks such as phishing simulations with Attack simulation training, web filtering through Global Secure Access or control over app consent complement these five points but do not replace them.

How do you recognise an AI-powered attack in your signals?

No log records whether an attacker used AI. What becomes visible is the pattern a successful attack leaves behind. Your team should know these signals:

• Sign-in through an intermediary server shortly after a click. Entra ID Protection then reports “Attacker in the Middle”, and Defender XDR raises alerts such as “Stolen session cookie was used” or “Possible AiTM phishing attempt”. Check whether an email with a link was delivered or clicked shortly before.
• Token from an unfamiliar environment. The “Anomalous token” detection in Entra ID Protection (P2) points to a token used from an unexpected location, device or client. For non-interactive sign-ins, this is a strong indication of session replay.
• New inbox rules. Rules that delete emails, move them to rarely used folders or forward them externally are a typical step before invoice fraud. Defender XDR reports suspicious inbox rules as a separate alert when Defender for Cloud Apps is connected to Microsoft 365.
• Unusual MFA approval. “Suspicious MFA authentication approval” (P2) fires when a push approval comes from a location that does not match the requesting device.
• New sign-in method after a help desk call. The Entra ID audit log shows when a method was registered or reset for an account. If a sign-in from an unknown device follows, someone should check with the employee directly.
• Payment change by email. The impersonation insight in Defender for Office 365 shows which senders posed as your protected people or domains.

What does Security Copilot do for your own team?

AI also helps defenders, mainly with volume and speed. The Phishing Triage Agent assesses emails reported by staff and separates real attacks from false alarms. It requires Defender for Office 365 Plan 2 and Security Copilot capacity. In the Defender portal, Security Copilot summarises incidents and suggests response steps. A monthly allowance is included with Microsoft 365 E5 and E7.

The limits are clear: agents have to be set up and given their own permissions, their assessments need expert review, and decisions about interventions in operations are still made by a responsible person. Security Copilot makes an existing team faster. It does not replace a missing on-call rota.

Frequently asked questions

Are AI-powered attacks realistic for mid-sized companies?

Yes, precisely because AI lowers the cost per target. Personalised emails and calls that used to be worthwhile only against large enterprises can now be produced at scale. The defence is the same as for large enterprises, and much of it is already licensed with Microsoft 365 Business Premium or E3.

Does MFA still help if phishing kits bypass it?

Classic MFA with a code or push approval still protects against stolen passwords, but not against a fake sign-in page that relays everything in real time. Phishing-resistant MFA with passkeys, Windows Hello for Business or certificates closes that gap.

How do we protect the help desk against cloned voices?

With a procedure that does not accept the voice as proof: a call-back to a stored number, confirmation by the line manager, or ID-based verification through account recovery in Entra ID. Only then is a Temporary Access Pass issued.

Which licences do we need for the key measures?

Phishing-resistant sign-in through Conditional Access, Token Protection and device compliance require Entra ID P1, included for example in Microsoft 365 Business Premium and E3. Risk-based policies and most Entra ID Protection detections require Entra ID P2, included in Microsoft 365 E5. Investigation in the Defender portal with Explorer and automated response to email incidents requires Defender for Office 365 Plan 2.

The next step

In a Security Assessment, we review which sign-in methods are actually used in your tenant, whether Conditional Access and Defender for Office 365 are configured against these attack patterns, and how your help desk recovers accounts. If you wish, we take over the ongoing analysis of Entra ID Protection and Defender XDR, including outside office hours, as part of Managed Security.

Book an introductory call