Identity
Microsoft 365 sign-ins, watched
Connecting Microsoft 365 takes one consent from an administrator. Jetstone then reads sign-in and audit records for the tenant, matches each sign-in to a managed device or not, and responds when an account is compromised.
What it looks for
Sign-ins from a new country or network, impossible travel, anonymising or hosting networks, legacy authentication, a success after a password spray, new forwarding or delete rules on a mailbox, application consents that reach mail or files, and new administrator role assignments.
Containment for a compromised account
Jetstone contains a compromised account in one step: it revokes sessions, disables the account and forces a password change, removes the inbox rule and revokes the application grant.
When the records arrive
Microsoft 365 audit records typically arrive 60 to 90 minutes after the event, and Microsoft gives no guarantee. Tenants with Microsoft Entra ID P1 or P2 also give Jetstone the sign-in log. The console shows which tier your tenant has.
- Consent
- One administrator consent. Withdraw it at any time in Microsoft Entra.
- Device match
- The agent reports the signed-in Entra account, so a sign-in is matched to a managed device or not.
Put Jetstone on your devices
Talk to Black Shard about Jetstone for your business.