MONTHLY TOPIC October 2026
Account Takeover Defense
Stop attackers even when passwords leak.
Passwords leak every day. This month, learn the three controls that make a stolen password useless, and check them off across your business in under an hour.
This month's lesson
Passwords are not enough. Billions of credentials are exposed in breaches every year, and attackers test them automatically against email, VPN, and cloud accounts in minutes.
The good news: three controls stop the vast majority of account takeover, and each one is free or already in your plan.
1. Multi-factor authentication (MFA) on every account, starting with admins. Even a stolen password cannot be used without the second factor. Use an authenticator app or a hardware key, not SMS, when you have the choice.
2. Phishing-resistant MFA for admins. Passkeys and hardware keys (FIDO2) bind the login to the real website, so they cannot be relayed by an adversary-in-the-middle phishing site. Give every global admin one.
3. Separation of admin accounts. A daily-use mailbox that also has global admin rights is one phishing click away from total compromise. Give admins a second, dedicated account for admin work.
This month, check these three things off your list. The guides below walk through each one step by step.
Checklist
- Enable MFA on every admin account
- Enable MFA on every user account
- Move at least one admin to a hardware key or passkey
- Create a dedicated admin account separate from daily email
- Block legacy authentication (IMAP/POP/SMTP) that bypasses MFA
- Review the admin list and remove anyone who no longer needs it
Guides for this topic
Enable MFA on Microsoft 365
Turn on multi-factor authentication for every account in your tenant, starting with admins. This single change blocks the vast majority of automated account takeover attempts.
Set Up Passkeys for Business Accounts
Passkeys replace passwords with a phishing-resistant credential stored on your device. They stop attackers from stealing credentials through phishing or adversary-in-the-middle attacks.
Secure Your Microsoft 365 Admin Accounts
Admin accounts are the highest-value target in your tenant. Separate them from daily work, give each admin a dedicated account, and lock them down with the strongest MFA you have.