Microsoft 365, Entra ID, and OAuth abuse remain a top initial-access channel

Identity abuse is one of the clearest operational threats in the feed, especially around Microsoft 365 and Entra ID. Attackers are using fake passkey enrollment, device-code flow a