Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

Discover how Abnormal uses TenantBase to provide in-depth insights into the users and applications across all of your mail tenants.
February 10, 2023

Are your tenants at risk?

No, we are not wading into the housing debate. We’re talking about mail tenants. Whether you have one tenant or one hundred, it is crucial to know who has access and what applications are integrated.

That second point is critical. Threat actors are using ostensibly legitimate (but in reality, compromised) applications to commandeer mail tenants–either with the goal of exfiltrating data or in the case of a recent attack identified by Microsoft, to run extensive spam campaigns.

We have customers with hundreds of mail tenants that previously needed to log in to each one individually in order to identify and investigate potential issues. But even if you only have one tenant housing your users, consider that our average customer (and maybe you reading this) has over 300 integrated third-party applications per tenant and hundreds, if not thousands of user mailboxes. Tenants are the hub for your organization’s communication and collaboration, so there needs to be an effective way to gain complete visibility into their activity.

Conduct a Unit Inspection with Abnormal TenantBase

The apartment puns write themselves, so forgive the headline, but Abnormal Security’s answer to tenant visibility concerns is the TenantBase Knowledge Base and the Security Posture Management Add-On. While the latter provides insight into high-impact changes to critical configurations such as tenant Conditional Access policies (CAPS), today we will take a closer look at TenantBase –– the hub for tenant activity data, and a key starting point for investigating unusual tenant events.

TenantBase consolidates the data captured in AppBase and PeopleBase into a comprehensive activity timeline—highlighting when a new application is installed or a user is added to a given tenant. Beyond this, TenantBase also surfaces the Tenant ID (with a link to the tenant) and the date a tenant was spun up so teams can directly access tenants from the Abnormal portal to correct issues.

Protect This House with TenantBase

Let’s dig in a bit deeper and take a look at exactly what information TenantBase provides. As mentioned, TenantBase provides a list of each tenant currently living in your cloud email environment along with a user and integrated app count–whether that means a single tenant for all users, multiple tenants for different business units, or multiple subsidiaries managed in one Abnormal portal.

Tenant Base1
  • Drilling down a bit deeper, though, into a particular tenant, you will be met with:
  • A granular timeline of tenant events (including apps installed and users registered to the tenant)

  • Tenant creation date and time

  • Tenant country

  • Tenant domain

  • Tenant ID (which links directly to the tenant’s admin authentication page)

If an Abnormal user wants to drill down into any of the configuration changes or other activities undertaken by a given user, each item in the timeline provides links to associated applications and users to cross-reference events in AppBase and PeopleBase.

Tenant Base2

As an example of a TenantBase use case using the above screenshot, let’s say that user Renee West’s account was found to have been compromised, and it is now critical to investigate recent user activity. Assuming the Enterprise Main tenant houses VIP mailboxes and other sensitive data, Renee’s recent installation of the Spoof Force application raises red flags (if only because of the name “Spoof Force,” but we’ll set that aside).

Now, with TenantBase, security teams can drill into the Spoof Force AppBase profile to learn more about this application.

Building a Strong Foundation with TenantBase

This is only the beginning for TenantBase. While understanding the applications and users is a crucial starting point, Abnormal continues to enhance visibility into tenant administrators, policies, and other key configurations to help protect what effectively amounts to the scaffolding for your entire cloud email security deployment.

Want to learn more about TenantBase? Request a personalized demo today.

Schedule a Demo
Abnormal Knowledge Bases: Using TenantBase to Prevent Mail Tenant Compromise

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.


See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

Integrates Insights Reporting 09 08 22

Related Posts

B 1500x1500 Adobe Acrobat Sign Attack Blog
Attackers attempt to steal sensitive information using a fraudulent electronic signature request for a nonexistent NDA and branded phishing pages.
Read More
B 4 15 24 RBAC
Discover how a security-driven RBAC design pattern allows Abnormal customers to maximize their user setup with minimum hurdles.
Read More
B 4 10 24 Zoom
Learn about the techniques cybercriminals use to steal Zoom accounts, including phishing, information stealers, and credential stuffing.
Read More
Social Images for next Cyber Savvy Blog
Explore how Alex Green, the CISO of Delta Dental, safeguards over 80 million customers against modern cyber threats, and gain valuable insights into the cybersecurity landscape.
Read More
B Images for EDB Blog from Sanjay
Abnormal is excited to announce the establishment of a strategic partnership with the Singapore Economic Development Board (EDB).
Read More
B Automotive Data Blog
Research reveals the automotive industry has become a popular target for business email compromise and vendor email compromise attacks. Learn why.
Read More