AegisAI Perspectives · 071
Schools stop account takeover of staff email with phishing-resistant MFA, alerts on risky sign-ins, limits on forwarding and same-day session revocation.
Schools stop account takeover of staff email with phishing-resistant sign-in, alerts on risky logins and same-day session revocation, because the FBI logged 193,407 phishing and spoofing complaints in 20241. AegisAI reads sign-ins and mailbox activity per staff account and raises one explained finding when behavior stops matching the owner23.
This page is the account takeover detail behind the education hub on how to choose email security for universities and K-12. For payroll mail hidden by inbox rules, read how universities stop payroll diversion and gift card scams.
AI removes the spelling cue that most staff training relies on. The FBI warns that criminals use generative AI tools to assist with language translations to limit grammatical or spelling errors3. Criminals also create messages faster, which lets them reach a wider audience with believable content.
In the UK, phishing was the main threat for 96% of secondary schools that identified a breach4. Compromised accounts or systems were used for illicit purposes at 23% of further and higher education institutions that found one.
Sign-in is where the control holds, because in Google Workspace passkeys and security keys both have the same level of phishing protection9, so a staff member who types a password into a fake page still does not hand over the account.
The UK Department for Education standard says MFA must be enabled for all staff accounts with access to cloud services or remote access to on-site systems6. In the Google Admin console, go to Security, Authentication, 2-step verification and set Enforcement to On. In Microsoft 365 without Conditional Access, turn on security defaults: users enter a number shown on screen into Microsoft Authenticator, which helps prevent MFA fatigue attacks15.
Google lets you set it from 1 day to 6 months, and new staff sign in with just their passwords during it10. Pick the shortest period your onboarding allows, because new staff accounts are the ones without a second factor.
Put finance, HR, admissions and IT admin staff in their own organizational unit and choose Only security key under Methods, which now supports both security keys and passkeys8. The DfE standard notes that passkeys suit staff who use a dedicated device. In Microsoft 365, create a Conditional Access policy that requires the built-in Phishing-resistant MFA strength16.
Microsoft recommends blocking sign-ins over legacy protocols that don't support multifactor authentication19. Use a Conditional Access policy for it, or security defaults in a tenant without Conditional Access licences.
In Microsoft Entra ID Protection, set a sign-in risk policy that requires multifactor authentication at Medium or High risk17. Full access to those features needs Microsoft Entra ID P2 or Microsoft Entra Suite. In Google Workspace, the suspicious login alert reaches the admin after the user fails or abandons an extra challenge11. Send both alerts to the person on call during school hours.
In Google Workspace, automatic forwarding is on by default; set it to internal addresses only, or turn it off so the option leaves Gmail settings13. In Microsoft 365, set the outbound spam filter policy to Off, which disables Inbox rules and mailbox forwarding that redirect messages to external addresses22.
In Microsoft 365, run Revoke-MgUserSignInSession, which immediately invalidates any active access using the stolen credentials20. Reset the password, then delete the user's app passwords, because a reset does not revoke them. In Google Workspace, suspend the user, which automatically resets their sign-in cookies12, then reset the password.
The page on how email account takeover works shows where each stage of a takeover leaves evidence, from the sign-in to the hidden rule.
| Control | Google Workspace | Microsoft 365 |
|---|---|---|
| Second factor for all staff | 2-step verification with Enforcement set to On | Security defaults, with number matching in Microsoft Authenticator |
| Phishing-resistant sign-in | Only security key, which includes passkeys | Phishing-resistant MFA strength in Conditional Access |
| New staff before enrollment | Enrollment period from 1 day to 6 months, password only | Security defaults suit tenants without P1 or P2 licences14 |
| Risky sign-in | Suspicious login alert after a failed or abandoned challenge | Sign-in risk policy at Medium or High, Entra ID P2 |
| Legacy protocols | Not covered on the cited Google pages | Block with Conditional Access |
| External forwarding | On by default; set to internal only or off | Outbound spam filter policy set to Off |
| Same-day containment | Suspend the user to reset sign-in cookies | Revoke sessions, then delete app passwords |
Illustrative example, figures are fictional. A school district with 2,400 staff on Microsoft 365 receives an AI-written email that copies its HR portal notice with no spelling errors. It reaches 180 staff in ten minutes, and five teachers type their passwords into the fake page. Four of them sign in with passkeys, so their stolen passwords open nothing. The fifth uses text message codes and types one into the page too. The attacker's sign-in comes from a new country and scores Medium risk, so the sign-in risk policy asks for multifactor authentication again and the attempt fails. IT revokes the teacher's sessions, deletes two app passwords and moves the teacher into the phishing-resistant group that afternoon.
AegisAI agents read sign-ins and mailbox activity per account, and raise one explained finding when behavior stops matching the owner. Every finding comes with recommended steps, and your team acts in Entra ID, Okta or Google Workspace. Account takeover protection is in early access25. Early access runs on the connection you already have, review-only, with no MX change, and you can see it on your own tenant.
Track three numbers from the day the settings go live.
Start at sign-in. Enforce 2-step verification or Microsoft MFA for every staff account, as the DfE standard requires for staff with cloud access. Then block legacy authentication and limit automatic forwarding to internal addresses. Add the phishing-resistant group for finance, HR and IT admins next.
It stops a stolen password from working on its own. For staff who handle money or records, require a phishing-resistant method: passkeys and security keys have the same level of phishing protection in Google Workspace, and Microsoft's Phishing-resistant MFA strength enforces them in Conditional Access.
Full access to Microsoft Entra ID Protection, which runs the sign-in risk policy, needs Microsoft Entra ID P2 or Microsoft Entra Suite. Microsoft says security defaults are probably not right for tenants with P1 or P2 licences, so a school without them starts with security defaults.
Suspending a user automatically resets their sign-in cookies, which signs the account out of browsers and mobile devices. Reset the password before you restore the account, and check the mailbox for new filters.
Yes, in Microsoft 365. App passwords aren't automatically revoked when you reset the password. The user deletes the old ones and creates new ones only where a device still needs one.
