claudetools/clients/bardach/reports/2026-06-05-account-investigation-mfa-enforcement.md

Bardach — M365 account investigation + MFA enforcement

Date: 2026-06-05 Tenant: bardach.net (dd4a82e8-85a3-44ac-8800-07945ab4d95f) Trigger: Barbara reported odd Outlook/MS login behavior — an "account locked" message when signing in on her phone, and brief SSL errors on her computer when authenticating with INKY to mark an item safe. Posture: read-only investigation (ComputerGuru Security Investigator), then one remediation write (enable Security Defaults) on Mike's explicit confirmation.

Verdict

Active password-spray / brute-force attack against the tenant — NOT a breach. No attacker sign-in succeeded; no malicious changes to mailbox, rules, forwarding, or delegates. The "account locked" messages were Entra Smart Lockout tripping from the spray (her own attempts get the same lockout message while lockout is active). The INKY SSL errors were collateral of the lockout state.

The real exposure was that MFA was not being enforced — both active accounts had MFA methods registered, but nothing required a second factor. Fixed by enabling Security Defaults.

Evidence (barbara@bardach.net, 30-day sign-in window)

• 111 interactive sign-ins, 14 non-US. Result-code breakdown:
  • 61x 50053 — "account is locked, too many incorrect attempts" (Smart Lockout)
  • 37x 50053 — "blocked, came from an IP with malicious activity"
  • 1x 50126 — invalid username or password
  • 12x 0 — successful, all legitimately hers
• Foreign source IPs: BE, LU, DE, SE, GB, NO, NL — distributed spray. Every foreign attempt failed.
• All 12 successful sign-ins are hers: US only (Phoenix/Tucson), normal apps (Windows Sign In, One Outlook Web, Inky Dashboard SSO), consistent ISP ranges (192.145.119.x, 45.86.210.x, 76.159.202.44).
• No persistence/compromise indicators: no mail forwarding (Graph + Get-Mailbox both clean), no SendAs/RecipientPermission, no hidden inbox rules; the single inbox rule is INKY's disabled "Move Graymail to folder" (benign). Password last changed 2026-01-18 (not altered by attacker). Directory audits in window are only Microsoft-backend "Update user" (Substrate Management) events. Identity Protection risky-user read returned Forbidden (no Entra P2 in tenant).
• conditionalAccessStatus = notApplied, authenticationRequirement = null on every sign-in — confirming no MFA enforcement was in place.

admin@bardach.net is also under attack

admin@bardach.net showed the same spray pattern (Germany, 50053/50126); recent interactive sign-ins in the sample were all failures/lockouts. Account has Authenticator + phone registered (MFA-ready). This is a whole-tenant target, not just Barbara.

Tenant facts

• Users: admin@bardach.net (enabled), barbara@bardach.net (enabled), stuart@bardach.net (disabled).
• Licensing: O365_BUSINESS (Office 365 Business), EXCHANGEENTERPRISE (Exchange Online Plan 2), EXCHANGEARCHIVE. No Entra ID P1 -> Conditional Access not available; Identity Protection not available.
• MFA methods registered: barbara@ = password, phone, Authenticator, Windows Hello (x3 devices). admin@ = password, email, phone, Authenticator. Both MFA-ready.
• Security Defaults: was isEnabled=false. No Conditional Access policies (no P1).

Action taken

• Enabled Security Defaults (PATCH /policies/identitySecurityDefaultsEnforcementPolicy {isEnabled:true} via ComputerGuru Tenant Admin SP). First read-back lagged (false); confirmed isEnabled=true on re-read and via re-PATCH returning the full policy object. Effective immediately.
• Effect: MFA enforced for all users tenant-wide; legacy/basic auth blocked (also closes a common spray entry point). Both active accounts have Authenticator -> no lockout. Security Defaults is all-or-nothing (no per-user/break-glass exclusions — that is a CA-only capability).
• Password: NOT rotated (Mike's call — MFA now gates the account).

Follow-ups (optional)

• Consider rotating admin@bardach.net's password — high-value target, recently all-failed sign-ins. MFA now mitigates, so no urgency.
• For finer control (named-location blocking, break-glass exclusions, risk-based MFA), Bardach would need Microsoft 365 Business Premium / Entra ID P1 — an upsell conversation, not a current need.
• Smart Lockout messages for Barbara should taper as the spray ages out. If lockouts persist, it is the ongoing spray, not her credentials.

Raw artifacts

/tmp/remediation-tool/dd4a82e8-85a3-44ac-8800-07945ab4d95f/user-breach/barbara_bardach_net/ (00_user .. 10_deleted JSON — sign-ins, rules, mailbox, auth methods).