It’s been a busy spring. Ransomware is on the move, and the same story keeps repeating. The attacker hit the on-prem environment hard, then quietly walked off with whatever data looked interesting in M365. Ransomware in a cloud tenant is not really a thing. Exfiltration is.
Entra and Defender for Endpoint are the backbone of most security setups, securing identities and endpoints. But AiTM phishing and device code phishing are sometimes able to bypass these controls. The user completes authentication. The token goes to the attacker. When that happens, SharePoint and OneDrive are up for grabs.
But what if the data itself was protected, regardless of who has access to it? Here are two Purview features I rarely see implemented but should be part of any organization’s security posture.
Block exfiltration attempts with IRM and Adaptive Protection
Purview Insider Risk Management (IRM) watches behavioral signals across M365 and builds a risk score for each user. If an attacker compromises a user account and uses this account to pull thousands of files from SharePoint sites, the account will typically result in being a high risk. With Adaptive Protection, we can wire this risk score directly into a Conditional Access policy using the Insider Risk condition. So, when a user hits high risk, the account gets blocked automatically and the exfiltration attempt is cut short. No one needs to watch a SIEM at 3am.
Block attacker from reading exfiltrated files
When you apply a sensitivity label with encryption, Azure RMS encrypts the file and embeds the policy metadata directly into it. Opening the file requires a valid use license from RMS, which in turn requires authentication against Entra. By default, this license is cached locally for 30 days. Set offline access to Never, and the client must re-authenticate against Entra every time the file is opened. An attacker operating from their own machine with a stolen token has no cached credentials, so the next open attempt after account revocation will fail.
Let’s say the same attacker was able to pull 3,000 files from these SharePoint sites without being blocked. Half are labeled Confidential with offline access set to Never. Six hours later the account is revoked. The unlabeled files are readable. The labeled ones are not and never will be. And it does not matter how they got the files out. Graph API, USB drive, Dropbox. The encryption follows the file.
One caveat though: with offline access set to Never, users need connectivity to Entra every time they open these files. A real tradeoff, but a reasonable one. After all, that is exactly the data the attacker is most interested in.
