Old test accounts are open doors
Microsoft’s own email was read through a forgotten test account without MFA. Go find yours.
In January Microsoft said attackers had read emails of some of its senior leaders. The way in wasn’t clever: password spraying against an old, non-production test account that didn’t have MFA. From there they used an app with too many permissions to reach real mailboxes.
If it happens to Microsoft, it happens in your tenant too. Every company has these:
- Test and demo accounts nobody owns.
- Service accounts with passwords that never change.
- Old apps and integrations still holding powerful access.
- Former staff who “might need access again”.
An hour to fix it:
- Export all accounts and sort by last sign-in. Disable anything unused for 90 days.
- Require MFA for every account that can sign in. No exceptions for “test”.
- List the apps that have access to mail and files. Remove what you don’t recognise.
- Block legacy sign-in methods that skip MFA.
Attackers don’t need your best-protected account. They need your most forgotten one.