Your computer is protected. Is your email?

What actually happens

Your email, files and Teams are in Microsoft’s cloud. To an attacker, your login is worth more than your laptop: it opens your mailbox, your shared files and every system that trusts your account.

Multi-factor authentication (MFA) stops most password attacks, and every account should have it. Some phishing pages now pass your code to Microsoft as you type it and keep the signed-in session, so the attacker is let in the moment you finish signing in.

Identity threat detection and response (ITDR) watches the account itself: sign-ins from unusual places, new inbox rules, a session suddenly used from another country. When something looks wrong, it can sign the account out everywhere and lock it until the real owner is confirmed.

What you can do today

• Turn on multi-factor authentication for every account, starting with email and administrator accounts.
• If a link asks you to sign in, close the page and go to the site yourself.
• Check your mailbox for forwarding or inbox rules you did not create.