AegisAI Perspectives · 095
This page lists the signals, recovery steps and licences to check when you choose account takeover protection for Microsoft 365, with a trial plan to run.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
The best account takeover protection for Microsoft 365 reads sign-ins and mailbox activity per account, flags inbox rules that forward mail to unknown addresses3, and says which recovery steps stay with your team. AegisAI agents read sign-ins and mailbox activity per account and raise one explained finding when behavior stops matching the owner15. Score every tool on those same points.
Use these three points as the first page of your evaluation sheet.
Microsoft lists inbox rules that forward email to unknown addresses, and newly added external forwarding, as common symptoms of a compromised mailbox. Defender for Office 365 can alert on unusual email patterns, such as phishing and spam sent internally from a trusted account7.
The guide to spotting a hijacked mailbox when MFA did not stop the attacker walks through each sign. Ask every vendor which mailbox and sign-in signals it reads, and how it combines them per account.
Short on time? Watch the explainer, or book a demo.
App passwords are not automatically revoked when you reset the password2. Access tokens issued by Microsoft Entra ID last for 1 hour by default4, and an application using access tokens keeps working until its token expires.
Some sessions sit outside Entra ID entirely. Entra ID cannot directly revoke a session token issued by an application, so that application must revoke it under its own policies5. Revoking active sessions is a step that cuts off access gained with stolen credentials1. Treat the reset as one step of recovery, never the last one.
In some cases Defender for Office 365 blocks a compromised account from sending more email until the security operations team resolves the issue8. Defender for Office 365 Plan 2 includes automated investigation and response for compromised users12.
Write down who does each recovery step for every tool on your shortlist.
AegisAI's product page notes that on Microsoft 365, sign-in reports need Entra ID P119. Automated investigation and response in Plan 2 requires audit logging, which is on by default14.
If your subscription lacks Plan 2, Microsoft offers a 90 day trial of it at no cost13. The guide to choosing email security for Microsoft 365 covers the wider licence picture. Confirm your Entra ID plan and audit log status in writing before the first vendor call.
Run the trial on a test account you control, and score each step.
Confirm the licence position: Entra ID P1 for sign-in reports, and Plan 2 if you want automated investigation.
Confirm audit logging is on in the tenant. It is on by default, and automated investigation needs it.
Connect the tool review-only, with no change to mail routing.
On the test account, create an inbox rule that forwards mail to an external address.
Send a small batch of internal messages from the test account that look like phishing.
Note the time each signal appears in the tool, and whether it raises one finding or several alerts.
Ask the tool for the recovery steps: revoke sessions and remove app passwords, which a reset does not revoke.
Record which of those steps the tool performs and which your team performs in Entra ID.
Put these eight steps in the trial plan and run them on every tool you test.
AegisAI agents read sign-ins and mailbox activity per account, and raise one explained finding when behavior stops matching the owner. They weigh impossible travel, new devices, inbox rule changes and suspicious internal sends together per account. Every finding comes with recommended steps, and your team acts in Entra ID or Google Workspace. Account takeover protection is in early access, which runs on the connection you already have, review-only, with no MX change.
The middle column shows what Microsoft 365 already does, so the gaps an added tool has to fill are visible.
| Criterion | Question for the trial | Built-in Microsoft 365 controls | AegisAI |
|---|---|---|---|
| Mailbox signals | Do inbox rule changes and internal sends count? | Alerts on phishing and spam sent internally from a trusted account | Inbox rule changes and suspicious internal sends weighed per account |
| Sign-in signals | Does it weigh travel and new devices per account? | Not covered in the Microsoft pages used here | Impossible travel and new devices weighed per account |
| One finding per account | Does it join signals into one explained result? | Alerts on anomalies such as internal phishing sends | One explained finding per account |
| Stop sending | Can it block a compromised account from sending? | In some cases blocks a compromised account from sending | Recommended steps, your team acts |
| Revoke sessions | Does it revoke the stolen session itself? | Revoking sessions is a response step your team runs | No edge: recommended steps, your team acts in Entra ID or Google Workspace |
| Licence first | What must you hold before the trial? | Plan 2 for automated investigation | Sign-in reports need Entra ID P1 |
| Mail routing | Does it change MX records? | No change | Review-only on the connection you have, no MX change |
60-second self-check
Six questions. Nothing is sent anywhere; the result shows on this page.
Score each row yes or no for every tool, keep the no-edge rows, and use the demo request page to arrange a test takeover review on your own tenant.
Illustrative example, figures are fictional. At 09:10 a finance user enters a password on a phishing proxy page, and the attacker keeps the session. At 09:14 an inbox rule starts forwarding invoices to an outside address. At 09:30 the account sends 22 internal messages asking colleagues to open a shared file. At 10:05 the help desk resets the password. The attacker's access token is still valid for up to 1 hour, and an app password set up at 09:20 still works, because a reset does not revoke it. Access ends only when sessions are revoked and the app password is removed at 10:40.
Run this timeline past each vendor and write down the minute its tool would have raised a finding.
Track three numbers from the first day of the trial.
Review all three on day 30 and keep the tool only if the first number fell and the third reached every incident.
The one that reads sign-ins and mailbox activity per account, catches inbox rules forwarding mail outside, and says which recovery steps it takes and which stay with your team. Test it on a controlled account before you buy.
Not always. A phishing proxy keeps the session cookie, so no second factor is asked for. The attacker then uses the stolen session instead of the password, which is why session revocation matters.
No. App passwords are not revoked by a password reset, and Entra ID access tokens last 1 hour by default. Revoke sessions and remove app passwords as separate steps.
Sign-in reports on Microsoft 365 need Entra ID P1, as the account takeover protection page cited above states. Automated investigation and response for compromised users is part of Defender for Office 365 Plan 2.
No. Entra ID cannot directly revoke a session token issued by an application, so that application has to revoke it under its own policies. List the third party apps your users sign in to and check how each one ends a session.
