Microsoft Conditional Access

CISA ran the same tradecraft at two organisations; only the water utility caught it

Detection at the first hop forced CISA's red team onto donated access at Organization B. It did not stop the team reaching the same sensitive systems it reached at Organization A.