Identity, Access, and Integration with Cloud Security Ecosystems
Identity, Access, and Integration with Cloud Security Ecosystems
This domain tests the identity control plane around email: who can sign in, what tokens and apps can access mail, and how email telemetry integrates with SIEM, SOAR, and other cloud security tools.
Core rules
- Conditional Access evaluates signals such as user, device, location, app, and risk. MFA alone does not block legacy authentication or token theft; block legacy protocols and require compliant devices for mail access.
- OAuth consent grants an application delegated or application permissions. Review enterprise applications and service principals; an illicit consent grant can read mail without a password.
- Integration uses audit logs, message trace, Graph API, and SIEM connectors. API permissions should be least privilege, and service accounts need monitored credentials and exclusions.
- Federation and directory sync affect authentication; break-glass accounts must be excluded from broad policies and monitored.
Worked example
A user approves a calendar app that requests Mail.Read. Later, mail is forwarded externally. Sign-in logs show no password spray; audit logs show a new service principal and consent. Response: revoke the app's permissions, remove the service principal, revoke user tokens, review mailbox rules, and hunt for other consent grants.
Traps
- Assuming MFA stops token replay; stolen session tokens can bypass password prompts.
- Ignoring app consent and service principals in incident scoping.
- Giving a SIEM connector tenant-wide permissions when read-only scoped access suffices.
- Locking out break-glass accounts with the same Conditional Access policy as admins.