This identity security case study began with a routine Microsoft 365 review for an Australian advisory firm. Compuloop found an active mailbox breach, contained access and strengthened identity and email controls.
Project technologies and related platforms we support
The firm came to us for a fixed-price health check ahead of a cyber insurance renewal. There was no suspicion of breach. The insurer had asked whether MFA was enforced and email authentication configured, and the firm wanted a second opinion before answering.
The review started with sign-in logs. Within two hours it had become an incident response project.
Two accounts accessed from an overseas IP range outside business hours. One mailbox had a hidden inbox rule forwarding messages containing “invoice”, “payment” or “remittance” to an external address. Legacy SMTP and IMAP enabled tenant-wide. One staff member had used an app password to sync their work mailbox to a personal Gmail account. MFA disabled for all 45 users, and audit logging retained only the default 90 days.
The attacker had been reading invoice and payment emails for 47 days. Three supplier invoices had been altered and re-sent from the breached mailbox with changed bank details. No funds were lost — only because one supplier's accounts team phoned to verify. That phone call was the difference between a security review and a fraud claim.
Two further issues mattered. The personal Gmail sync meant company data sat outside the firm's control with no visibility, no retention and no clear way to cut off access. And the absence of MFA meant the breach was not a clever attack — it was almost certainly a attack using reused passwords that would have been stopped by a control the firm already paid for through its Microsoft licences.
Microsoft Defender brings incident details into a single view. This example shows how security teams can review affected devices and incident status.
Microsoft Entra Conditional Access evaluates signals and applies access controls. It helps explain the identity controls described in these projects.
Microsoft’s report-only example illustrates how administrators can evaluate access policies.
A Microsoft product example illustrates OneDrive access during offboarding.
Revoked all active sessions and refresh tokens, reset credentials, removed malicious inbox rules and external forwarding, disabled legacy authentication tenant-wide, removed the third-party app password. Preserved logs and exported evidence before any change.
Reviewed all 45 mailboxes for similar rules and forwarding, checked sign-in activity for unusual places and travel patterns, and prepared a factual incident summary for the insurer and two affected suppliers. Advised on the need to assess whether the breach had to be reported.
MFA with number matching across all users. Conditional access: compliant device or MFA, geo-restriction to Australia plus travel exception group, high-risk sign-in block. Removed standing admin roles, created three privileged accounts, enabled self-service password reset.
Defender for Office 365 P1 with safe links, safe attachments and anti-phishing. DMARC p=none → p=reject with DKIM and SPF aligned. App consent restrictions, 12-month audit retention, and a 45-minute all-staff session on credential hygiene and invoice fraud.
The project also established repeatable processes. These controls support ongoing operation after the initial rollout.
Talk through your priorities, current systems and next practical step with Compuloop.
The following before-and-after figures relate to this engagement. The scope and starting position matter when comparing them with another business.
| Measure | Before | After |
|---|---|---|
| MFA enforcement | 0% of users | 100% with number matching |
| Legacy authentication | Enabled tenant-wide | Blocked |
| Compromised / dormant accounts | 2 active, 6 dormant | 0 |
| External mail forwarding rules | 1 malicious, 4 unknown | 0 unauthorised |
| DMARC policy | p=none | p=reject |
| Audit log retention | 90 days | 12 months |
| Phishing attempts blocked (month 1) | Not measured | 312 |
Phishing triage per staff member per week
Password resets per month (SSPR)
Weekly staff time recovered across firm
Inbox rule audit (was ad hoc)
Project-specific financial model. Avoided losses and productivity benefits are estimates, not guaranteed cash savings or returns.
| Line item | Value |
|---|---|
| Project investment (incident + 3 weeks) | $19,500 |
| Fraud loss prevented (three altered invoices) | ~$50,000 |
| Avoided: forensic investigation, legal, notification | $40,000–$120,000 |
| Avoided: insurance premium increase (8–15%) | ~$2,400–$4,500 / yr |
| Annual recurring: phishing triage time saved | ~$28,000 / yr |
| Annual recurring: helpdesk resets saved | ~$3,600 / yr |
| Payback | Immediate (fraud loss alone exceeds investment 2.5×) |
Background guidance: read the relevant official framework or product documentation. This explains the technology; it is not independent verification of this client project.
If this identity security case study reflects a problem in your business, start with a scoped conversation. Tell us about your sites, people, systems and current priorities. We can then identify the right assessment, the practical constraints and the evidence you need.
