Fortune 500 Azure Tenants Breached: 5 Settings SMBs Should Lock Down Now

A threat actor calling themselves “TheHatman” breached Azure and Entra ID tenants belonging to McDonald’s, Tata Consultancy Services, Vodafone, and several other Fortune 500 companies. The campaign, which surfaced publicly on August 18, resulted in the exfiltration of complete employee directories: names, email addresses, job titles, organizational hierarchies, group memberships, and global admin account identifiers. McDonald’s alone lost 1.7 million records. TCS lost 800,000. Vodafone lost 425,000.

These weren’t small companies with underfunded security teams. They were Fortune 500 organizations with dedicated cybersecurity staff, and they still got breached on the same platform your business runs on. If you’re using Microsoft 365 or Azure, the same attack vectors that hit McDonald’s can be pointed at your tenant. The difference is that most SMBs have fewer controls in place to stop them.

How the Attack Worked

Security researchers attribute the campaign to four overlapping attack vectors, any one of which can compromise a tenant on its own.

Password spray. The attacker tested commonly used passwords against large numbers of accounts. This avoids the account lockout thresholds that trigger after repeated failed attempts on a single account. Instead of trying 100 passwords against one account, the attacker tried one password against 100 accounts, then moved to the next password. Many organizations still have accounts using predictable passwords, and password spray finds them without triggering alerts.

MFA fatigue. For accounts protected by push-notification MFA, the attacker sent repeated authentication prompts until someone approved one. TCS specifically cited MFA fatigue as one of the techniques used against their environment. We’ve covered how MFA prompt bombing works and how number matching stops it in a previous post.

Infostealer malware. Infostealers running on compromised endpoints harvested session tokens and browser cookies, letting the attacker bypass MFA entirely. A stolen session token doesn’t need a password or a second factor because the authentication already happened. Our coverage of how infostealers bypass MFA through session cookie theft explains the mechanics in detail.

Third-party app abuse. Entra ID allows third-party applications to request permissions through OAuth consent grants. The attacker exploited applications with overly broad read privileges to pull tenant directory data at scale. Many organizations have dozens of third-party apps connected to their tenant that were approved once and never reviewed again.

Why Stolen Employee Directories Are Dangerous

The data stolen in this campaign wasn’t financial records, customer databases, or intellectual property. It was employee directories with organizational charts. That might sound like a lower-severity breach, but for the companies affected and their partners, it’s the foundation for the most damaging attacks that come next.

Targeted business email compromise. When an attacker knows who reports to whom, who handles finance, and who has executive authority, they can craft BEC emails that reference real reporting relationships and internal structures. An email from someone claiming to be the CFO carries more weight when the attacker knows the CFO’s actual name, direct reports, and which department handles wire transfers. We’ve written about how BEC campaigns work and the controls that stop them.

Spear-phishing with internal context. Generic phishing emails get caught by filters. Emails that reference a real manager’s name, a real team structure, or a real project name bypass both technical filters and human suspicion. The org-chart data from this breach gives attackers everything they need to write emails that look like they came from inside the organization.

Credential harvesting at scale. With a complete list of email addresses and job titles, the attacker can target credential theft campaigns at specific high-value individuals: IT admins, finance controllers, and executives. The directory data tells them exactly who to target and what those people’s roles are.

Five Settings to Check This Week

These are the specific Entra ID and Microsoft 365 configurations that would have blocked or significantly limited the attack vectors used in this campaign. You can hand this list to your IT team or managed security provider and ask them to verify each one.

1. Enforce Phishing-Resistant MFA with Number Matching

Standard push-notification MFA is what allows MFA fatigue attacks to work. The fix is to require number matching on all authentication prompts. With number matching enabled, the MFA prompt displays a two-digit number that the user must type into their authenticator app. An attacker spamming push notifications can’t succeed because they don’t know the number displayed on the login screen.

Better still, move to phishing-resistant MFA methods: FIDO2 security keys, Windows Hello for Business, or Microsoft Authenticator passkeys. These methods are immune to both MFA fatigue and adversary-in-the-middle phishing because authentication is tied to the specific site and device. If you haven’t started that transition, our post on Entra passkey rollout walks through the process.

2. Set Up Conditional Access Policies

Conditional access is where most SMBs have the biggest gap. These policies control who can access your tenant, from where, on what devices, and under what conditions.

Block legacy authentication. Protocols like POP3, IMAP, and SMTP AUTH don’t support MFA at all. Attackers use them to bypass your MFA requirements entirely. A conditional access policy that blocks these protocols closes one of the most common entry points.

Require compliant or managed devices. Restrict access to devices enrolled in your organization’s device management. Even if an attacker steals credentials and passes MFA, they can’t log in from an unmanaged device.

Block sign-ins from unexpected locations. If your business operates in Texas and Oklahoma, there’s no legitimate reason for someone to authenticate from a foreign IP address at 3 AM. Conditional access can enforce geographic restrictions that would have blocked the password spray traffic in this campaign.

Enable risk-based sign-in policies. Microsoft Entra ID Protection scores each sign-in based on signals like impossible travel, anonymous proxies, and password spray patterns. Conditional access can automatically block or require additional verification for high-risk sign-ins.

3. Audit Third-Party App Permissions

This is the one most organizations skip entirely. Go to the Entra admin center, open Enterprise Applications, and review every app that has been granted permissions to your tenant. Pay attention to apps with Directory.Read.All, User.Read.All, or similar broad directory permissions.

For each app, ask: does this app still need access? Does it need the level of access it has? Was this consent granted by an admin or by an individual user? Revoke permissions for apps that are no longer in use or that have broader access than their function requires. Our guide to auditing third-party M365 app permissions covers this process step by step.

Going forward, configure your tenant to require admin consent for new app registrations. This prevents individual users from granting tenant-wide permissions to apps without IT review.

4. Deploy Endpoint Protection That Catches Infostealers

Infostealers are the attack vector that bypasses MFA entirely by stealing session tokens from the browser. Traditional antivirus doesn’t reliably catch modern infostealers because many of them operate as legitimate-looking browser extensions or use living-off-the-land techniques to avoid detection.

You need endpoint detection and response (EDR) that monitors for credential access behaviors, not just known malware signatures. EDR platforms detect when a process attempts to access browser credential stores, session cookie databases, or Windows credential manager, and they block the exfiltration before the tokens leave the endpoint.

This is also where managed detection matters. An EDR platform that generates alerts but has no one watching them around the clock is an expensive log generator. The value is in having a SOC team that investigates alerts in real time and responds before stolen tokens can be used.

5. Monitor for Leaked Credentials

The attack on these Fortune 500 tenants used credentials that were already compromised before the breach began. Password spray campaigns succeed because they’re testing passwords that have appeared in previous breaches, and credential stuffing attacks rely on password reuse across services.

Microsoft Entra ID Protection includes leaked credential detection that flags accounts whose passwords appear in known breach databases. Enable this and configure it to force a password reset when a leaked credential is detected.

Supplement this with dark web monitoring that scans for your domain’s email addresses and credentials appearing on criminal marketplaces and paste sites. If an employee’s credentials show up in an infostealer dump, you want to know before an attacker uses them.

What This Means for Your Business

The companies breached in this campaign had security teams, enterprise budgets, and access to every tool on the market. They still got breached because the attack vectors exploited configuration gaps, not technology gaps. Password spray works when accounts have weak passwords. MFA fatigue works when push notifications don’t require number matching. Infostealers work when endpoints lack behavioral detection. Third-party apps leak data when no one reviews their permissions.

Every one of those gaps is more common in SMBs than in Fortune 500 companies. If you’re running Microsoft 365 and haven’t verified these five settings, your tenant is more exposed than the ones that were breached.

If your Dallas-Fort Worth business or any of your Texas locations need help locking down these configurations, our team can run through each of these settings with you and close the gaps before they’re exploited.