Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

Discover how Abnormal uses TenantBase to provide in-depth insights into the users and applications across all of your mail tenants.
February 10, 2023

Are your tenants at risk?

No, we are not wading into the housing debate. We’re talking about mail tenants. Whether you have one tenant or one hundred, it is crucial to know who has access and what applications are integrated.

That second point is critical. Threat actors are using ostensibly legitimate (but in reality, compromised) applications to commandeer mail tenants–either with the goal of exfiltrating data or in the case of a recent attack identified by Microsoft, to run extensive spam campaigns.

We have customers with hundreds of mail tenants that previously needed to log in to each one individually in order to identify and investigate potential issues. But even if you only have one tenant housing your users, consider that our average customer (and maybe you reading this) has over 300 integrated third-party applications per tenant and hundreds, if not thousands of user mailboxes. Tenants are the hub for your organization’s communication and collaboration, so there needs to be an effective way to gain complete visibility into their activity.

Conduct a Unit Inspection with Abnormal TenantBase

The apartment puns write themselves, so forgive the headline, but Abnormal Security’s answer to tenant visibility concerns is the TenantBase Knowledge Base and the Security Posture Management Add-On. While the latter provides insight into high-impact changes to critical configurations such as tenant Conditional Access policies (CAPS), today we will take a closer look at TenantBase –– the hub for tenant activity data, and a key starting point for investigating unusual tenant events.

TenantBase consolidates the data captured in AppBase and PeopleBase into a comprehensive activity timeline—highlighting when a new application is installed or a user is added to a given tenant. Beyond this, TenantBase also surfaces the Tenant ID (with a link to the tenant) and the date a tenant was spun up so teams can directly access tenants from the Abnormal portal to correct issues.

Protect This House with TenantBase

Let’s dig in a bit deeper and take a look at exactly what information TenantBase provides. As mentioned, TenantBase provides a list of each tenant currently living in your cloud email environment along with a user and integrated app count–whether that means a single tenant for all users, multiple tenants for different business units, or multiple subsidiaries managed in one Abnormal portal.

Tenant Base1
  • Drilling down a bit deeper, though, into a particular tenant, you will be met with:
  • A granular timeline of tenant events (including apps installed and users registered to the tenant)

  • Tenant creation date and time

  • Tenant country

  • Tenant domain

  • Tenant ID (which links directly to the tenant’s admin authentication page)

If an Abnormal user wants to drill down into any of the configuration changes or other activities undertaken by a given user, each item in the timeline provides links to associated applications and users to cross-reference events in AppBase and PeopleBase.

Tenant Base2

As an example of a TenantBase use case using the above screenshot, let’s say that user Renee West’s account was found to have been compromised, and it is now critical to investigate recent user activity. Assuming the Enterprise Main tenant houses VIP mailboxes and other sensitive data, Renee’s recent installation of the Spoof Force application raises red flags (if only because of the name “Spoof Force,” but we’ll set that aside).

Now, with TenantBase, security teams can drill into the Spoof Force AppBase profile to learn more about this application.

Building a Strong Foundation with TenantBase

This is only the beginning for TenantBase. While understanding the applications and users is a crucial starting point, Abnormal continues to enhance visibility into tenant administrators, policies, and other key configurations to help protect what effectively amounts to the scaffolding for your entire cloud email security deployment.

Want to learn more about TenantBase? Request a personalized demo today.

Schedule a Demo
Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

See Abnormal in Action

Schedule a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.


See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

See a Demo
Integrates Insights Reporting 09 08 22

Related Posts

B 3 21 23 CFO
Bill Losch of Okta discusses the macroeconomic environment and how CISOs can prepare for budget discussions with their CFOs.
Read More
B Business Email Compromise Response
Knowing what to do after receiving a business email compromise attack is essential for preventing costly consequences. Learn how to respond to BEC attacks.
Read More
B 36 M
Vendor email compromise is expensive. See how Abnormal protected our customer from a $36 million invoice fraud attack.
Read More
B Keeping VIP Emails Safe
Learn why executives are popular targets for account takeovers, the consequences of a successful takeover, and how organizations can prevent these attacks.
Read More
B TAG Cyber Future of Cloud Email Security
In the final post of our series with Ed Amoroso, the TAG Cyber CEO discusses some of the defensive and offensive trends for cloud email.
Read More
B SVB Closure Cybersecurity Threats
The Silicon Valley Bank (SVB) closure has created opportunities for threat actors to launch more convincing email attacks. Here's how to lower your risk.
Read More