Last updated: 7 November 2026
ITDR (identity threat detection and response) protects the accounts and sign-ins attackers now target first. It watches Microsoft 365 and Entra for signs of account takeover, such as impossible-travel logins, stolen session tokens and malicious mailbox rules, then locks the account and alerts a human. Because stolen credentials start more breaches than any other method, identity is the new perimeter.
Why identity is now the main target
Attackers no longer break in; they log in. The 2025 Verizon report found credential abuse was the top initial access vector at 22% of breaches. Once they have a password or a session token, they can read email, send fake invoices and move through your cloud files, often with no malware at all. Antivirus and EDR cannot see that, which is where ITDR comes in.
What does ITDR detect?
Account takeover
Sign-ins from unusual places, devices or impossible travel, flagged and blocked.
Mailbox rule abuse
Hidden forwarding or delete rules that attackers use to hide fraud.
Token and MFA theft
Stolen session tokens and MFA fatigue attacks that bypass a password.
Risky privilege changes
New admins, new app consents and changed security settings that nobody approved.
ITDR, MFA and Conditional Access: how they work together
| Layer | What it does | When it acts |
|---|---|---|
| MFA | Asks for a second proof of identity | Before sign-in |
| Conditional Access | Allows or blocks sign-ins by device, location and risk | During sign-in |
| ITDR | Detects takeover and contains it | After a login or token is stolen |
MFA and Conditional Access reduce the chance of a takeover. ITDR assumes one will eventually get through and limits the damage. See our answers on MFA and Conditional Access.
How ABCOM helps
We harden Microsoft 365 and Entra with MFA, Conditional Access and security baselines, and our managed plans add identity threat detection so that suspicious sign-ins and mailbox changes are investigated, not just logged. This is part of how we help businesses protect Microsoft 365 accounts.
Quick answers
Is MFA enough to stop account takeover?
No. MFA greatly reduces risk, but attackers use MFA fatigue prompts, phishing proxies and stolen session tokens to get round it. ITDR watches for the aftermath and acts when it happens.
Does Microsoft 365 include ITDR?
Microsoft Entra ID Protection, in Entra ID P2 and some Microsoft 365 plans, gives risk-based detection. Many small businesses add a managed service that monitors the alerts and responds out of hours.
What is the difference between ITDR and EDR?
EDR protects devices. ITDR protects identities and sign-ins in the cloud. Attackers use both routes, so businesses need both.
Concerned about account takeover in Microsoft 365? We can review your sign-in protection in a free call.
Related answers and guides
- What is MFA?
- What is Conditional Access?
- What is Microsoft Entra?
- What is EDR?
- EDR, MDR, XDR, SIEM, SOC and ITDR explained
- Giving an AI agent your logins
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.