Technology @ Your Service - KW Corp, Fowlerville, MI
Most security advice about Microsoft 365 is about keeping attackers out: strong passwords, MFA, and training people to spot phishing. That advice still matters. But recent research from Varonis Threat Labs is a reminder that it also matters what an attacker can leave behind once they are in, and whether your cleanup process would actually remove it.
What the research showed
Last month, Varonis Threat Labs published research on a technique it calls TrustSink. In a Microsoft Entra test tenant, Varonis showed that an attacker who already controls a highly privileged admin account can add a malicious external MFA method to the tenant's authentication methods policy.
External MFA is a legitimate Entra feature. Microsoft describes it as a way to "let users choose an external provider to meet MFA requirements," and it is managed in the authentication methods policy "just like built-in methods." Once an external method is enabled, users in scope can choose it for MFA prompts. That is useful when you really do use a third-party MFA provider. It is a problem when someone you did not authorize adds one.
In Varonis's test, the rogue method sat inside an otherwise normal Microsoft sign-in, and the sign-in completed without errors. Varonis reported that it could capture user passwords. The detail that should get every IT team's attention is this: in Varonis's test, a password reset did not remove the provider; it captured the new password at the next sign-in.
Why this is a post-compromise risk, not a new front door
It is important to keep this in perspective. Adding an external MFA method requires highly privileged admin roles such as Global Administrator or Authentication Policy Administrator. Varonis itself describes TrustSink as a post-compromise technique. An attacker has to already control one of those accounts.
That is different from the threats we have covered recently. Device-code phishing and session theft both target individual users and their sign-ins. This risk is about tenant-wide settings. If a privileged account is compromised, the attacker may be able to plant persistence that affects every user in scope until someone finds and removes it.
We are not aware of any public reports of this being used against real organizations. Varonis demonstrated it in a test environment. We also did not find a Microsoft response, advisory, or CVE in the coverage. But the defensive steps below are good identity hygiene whether or not this specific technique ever shows up in the wild.
Step 1: Audit your external MFA methods now
This is the quickest, highest-value check. In the Microsoft Entra admin center, go to Entra ID, then Authentication methods, and review the list of methods. Look specifically for any external MFA methods.
- If your organization does not use a third-party MFA provider, there should be no external MFA methods configured.
- If you do use one, confirm it is the provider you expect, that someone on your team knows who set it up and when, and that it is scoped to the right users.
- If you find something you cannot explain, treat it as a potential incident (see Step 6), not a cleanup chore.
While you are there, look at the related audit events in the same time window: "Add application," "Add service principal," and consent grants. Varonis lists these alongside the policy change as signals worth reviewing.
Step 2: Limit who can change the authentication methods policy
According to Microsoft, the Authentication Policy Administrator role "can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials." Global Administrator can manage all aspects of Entra ID. Microsoft also notes that granting admin consent for an external provider's application requires at least the Privileged Role Administrator role.
Those three roles deserve extra care. Microsoft's own best practices for Entra roles recommend:
- Applying least privilege, so people get only the roles they need.
- Assigning Global Administrator to fewer than five people.
- Keeping privileged role assignments under 10.
- Running recurring access reviews to remove role assignments that are no longer needed.
- Keeping two cloud-only emergency (break-glass) accounts.
For many small businesses, the honest answer to "who is a Global Admin?" is "more people than we thought," often including former staff, a past vendor, or a shared account. That is a good place to start.
Step 3: Alert on Authentication Methods Policy Update
Changes to the authentication methods policy appear in Entra audit logs as "Authentication Methods Policy Update" events. In most small organizations, this setting changes rarely. That makes it a great candidate for an alert: if it changes and nobody on your team made a planned change, someone should look right away.
Varonis also recommends watching sign-in logs for MFA satisfied by an unfamiliar external provider. Your IT partner or security tooling can help route these signals to someone who will actually see them.
Step 4: Use PIM so admin access is not standing access
Microsoft recommends Privileged Identity Management (PIM) for just-in-time access to admin roles. Instead of someone being a Global Admin all day, every day, they activate the role when they need it, for a limited time. PIM can also send notifications when users are added to highly privileged roles.
Fewer standing admins means fewer accounts an attacker can use to change tenant-wide settings. Note that PIM requires Entra ID P2 or Entra ID Governance licensing, so it is worth checking what your current Microsoft 365 plan includes.
Step 5: Require phishing-resistant MFA for admins
Since this risk starts with a compromised admin account, protecting those accounts is the best prevention. Microsoft provides a Conditional Access policy that requires the phishing-resistant MFA authentication strength for admin roles. Methods such as FIDO2 security keys and Windows Hello for Business fit here, and Varonis also recommends moving users toward them.
Microsoft's recommended role list includes Global Administrator and Privileged Role Administrator, but not Authentication Policy Administrator. Organizations can include or exclude roles, and we recommend adding Authentication Policy Administrator. A few practical notes from Microsoft:
- Have admins register phishing-resistant methods first, so nobody gets locked out.
- Exclude your break-glass accounts.
- Start the policy in report-only mode, review the results, then turn it on.
Step 6: Fix the order of your incident response
The usual first move after a suspected account compromise is "reset the password." In Varonis's test, that alone was not enough. If you suspect a rogue external MFA method, the order matters:
- Disable or remove the suspicious external method first.
- Remove the related application, service principal, keys, and consent grant.
- Identify every user who signed in through that method.
- Then reset passwords and revoke sessions for affected users.
- Review and reduce standing Global Administrator and Authentication Policy Administrator assignments.
Write this order into your incident response plan now, while things are calm.
The bigger lesson: identity settings need owners
Microsoft 365 tenants accumulate settings over the years. Many small businesses set things up once and never revisit them. Research like this is a good prompt to make sure someone owns your identity configuration: knows who the admins are, knows which authentication methods are allowed, and gets told when either changes.
If you would like help reviewing your Microsoft 365 and Entra identity settings, KW Corp's Managed IT team works with businesses across Mid-Michigan to keep admin access tight and sign-in settings documented.
Contact KW Corp for an identity review
KW Corp - Technology @ Your Service
307 W. Grand River Ave, Fowlerville, MI 48836 | 517-223-3610 | support@kw-corp.com