Email Account Takeover Protection can now ingest posture events*—specifically high-impact changes to user privileges and when a user changed mail tenant conditional access policies. These changes can indicate an attacker attempting to establish persistence and expand the attack surface area. Ingesting these signals and aggregating them in Account Takeover Cases further aids investigation and gives security teams greater visibility into the downstream impact of account compromise.

*Requires Email Security Posture Management to use.