Category: Productivity
Secure Microsoft 365 browsing
Microsoft 365 sign-in runs on Microsoft Entra ID. Attackers relay MFA, abuse consent, and steal tokens. Entra token protection only partly covers browsers.
Quick answer
Microsoft Entra ID handles Microsoft 365 sign-in. Fake sign-in pages relay MFA codes in real time. Consent phishing gets users to approve malicious apps. Token theft replays a session stolen after sign-in. Entra token protection binds tokens to the device. It is generally available for supported native apps. Browser support is a narrow preview. It covers some web apps that use Azure Resource Manager. Use phishing-resistant MFA and restrict user consent. Block device code flow where you can.
Last updated
2026-11-01
Main browser risks for Microsoft 365
- Outlook-delivered phishing that leads to fake Microsoft sign-in pages or consent prompts.
- Malicious SharePoint/OneDrive links used to deliver malware or harvest credentials.
- Phishing links and files sent in Teams chats.
- Token theft and session replay after MFA via proxy-style phishing kits.
- OAuth consent abuse that grants access to mailboxes and files via third-party apps.
- Device code phishing that gets users to approve an attacker's sign-in.
- Entra admin session compromise leading to Conditional Access changes or new app registrations.
- Data leakage from copying sensitive content into untrusted web apps or AI tools in adjacent tabs.
- Risky extension installs that can read and modify web pages and exfiltrate data.
Typical sensitive data in Microsoft 365
- Email content, attachments, and contact directories.
- SharePoint sites and documents.
- OneDrive files and shared folders.
- Teams/Outlook calendar and meeting metadata.
- User identities and session tokens for M365 apps.
- Conditional Access policies and authentication methods in Entra ID.
- Enterprise app registrations, consent grants, and app secrets.
- Admin center settings and audit logs (for admins).
How do Microsoft 365 and Entra ID accounts get taken over?
| Attack | How it starts in the browser | Microsoft control |
|---|---|---|
| Relayed MFA | A fake sign-in page passes your password and code to Microsoft in real time. | Phishing-resistant MFA. CISA calls FIDO/WebAuthn the only widely available phishing-resistant method. |
| Consent phishing | A real Microsoft consent screen asks you to approve a malicious app. | Limit user consent to verified publishers and low-risk permissions. |
| Device code phishing | A message asks you to enter a code on Microsoft's real sign-in page. | Block device code flow in Conditional Access wherever possible. |
| Token replay | A token stolen after sign-in is reused from another device. | Token protection. Browser support is a preview for some web apps that use Azure Resource Manager. |
| Admin session theft | An admin uses Entra in the same browser profile as email and research. | A separate admin browser profile and phishing-resistant MFA for admin roles. |
Controls from Microsoft Learn and CISA, checked October 30, 2026. The separate admin browser profile is general practice.
Recommended controls by role
IT Admins
- Keep Entra and admin center work in a separate profile.
- Limit user consent to verified publishers and low-risk permissions.
- Block device code flow except where a device requires it.
- Lock down extensions and browser permissions via enterprise policy.
Security
- Monitor OAuth grants, new app registrations, and mailbox rules.
- Pilot token protection in report-only mode first.
- Enforce phishing-resistant MFA for privileged roles.
- Investigate suspicious links and file shares in an isolated browser.
Finance
- Treat links and attachments from external senders as untrusted.
- Verify payment and bank detail changes outside email.
- Restrict downloads from unknown sources; prefer managed file transfer.
Where Shield fits with Microsoft 365
The controls above are general security practices, not Legba features. Microsoft 365 is not a Legba integration.
Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.
Limits
Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.
Free for 30 days. No card required.
What to do next
Start with the narrow fixes. Block device code flow and limit user consent. Move admins to phishing-resistant MFA. Keep admin sessions in their own browser profile. Open unknown links away from signed-in sessions.
Microsoft 365 security questions
Does Entra token protection work in the browser?
How does device code phishing work against Microsoft 365?
What is consent phishing in Microsoft 365?
Should admins use a separate browser profile for Entra?
Does isolation replace Conditional Access?
References
- 01
- 02
- 03
- 04
- 05
Keep exploring
- Device code phishing and SOC visibilityWhy device code lures slip past static URL analysis.
- How to open a suspicious link safelyVerify the sender first. Isolate only what you must inspect.
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All secure app guidesBrowse apps by category.
- Browser threatsUnderstand threats and mitigation patterns.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
