Identity-based threats are on the rise, with 67% of organizations having seen identity-related incidents increase in just the past three years, and more than one in three say identity-based attacks now make up over 40% of all their security incidents.

More and more, attackers are attempting to compromise legitimate user accounts rather than risking noisier intrusions.

Enforcing strong MFA and conditional access policies

Multi-factor authentication is non-negotiable at this point. But MFA just isn’t consistently implemented. Across our analysis of over 12,000 Microsoft 365 tenants, 66% had weak MFA posture. Additionally, traditional MFA methods (for example, SMS messages and basic push notifications) are no longer sufficient for high-risk environments. Attackers are increasingly bypassing these controls through techniques such as MFA fatigue (also known as “push bombing”), adversary-in-the-middle phishing proxies, and session cookie theft.

To guard against this, organizations should adopt phishing-resistant MFA, such as FIDO2/WebAuthn hardware security keys or modern passkeys, and platform biometrics like Windows Hello or Apple Touch ID.

MFA should be paired with conditional access. Conditional access policies look beyond login credentials to include additional context—such as device health, location, time of day, and risk signals—before granting access and are commonly used to block or restrict legacy authentication protocols (IMAP, POP3, SMTP) that don’t support modern MFA.

Reducing excessive privileges

The principle of least privilege (PoLP) ensures that users receive only the level of access required to do their jobs. Enforcing this requires auditing and restricting overprivileged accounts. This can be taken further by making sure no single human administrator holds domain-level rights in Active Directory while also having global admin rights in cloud directories like Microsoft Entra ID. Broad cross-platform access can be reserved for tightly controlled emergency accounts. This prevents an attacker who compromises an on-premises server from automatically taking control of cloud infrastructure as well.

PoLP can also be extended to include just-in-time (JIT) access, granting elevated privileges only for a limited time to perform a specific task.

Removing stale or risky accounts

Stale accounts are those that haven’t been logged into for a prolonged period (often 90–180 days). This occurs for many reasons: employees leave the organization, temporary accounts are created for testing, or service accounts are forgotten. The result is that these accounts lie dormant, just waiting to be exploited. Adding to the risk is that stale accounts often escape modern security enforcement, such as mandatory MFA. Identity hardening requires continuously identifying and removing inactive accounts.

Reviewing admin roles and service accounts

Admin privileges should be granted to the fewest accounts possible, with extra emphasis on enforcing strict security policies for them. For example, global admin accounts shouldn’t be used for day-to-day tasks. With the increasing use of automation, special attention must also be paid to non-human service accounts. These accounts are designed to run background processes and system-level integrations, giving them high-level access. The problem is that machines can’t complete biometric challenges, enter one-time codes, or respond to push notifications—meaning they bypass MFA.

Hardening service accounts means auditing their permissions to restrict their reach, migrating them to Group Managed Service Accounts (gMSAs) to automate password rotation, and using Kerberos to limit where and how they can authenticate.

Preventing policy drift over time

Configuration drift is the tendency for gaps to creep in between security policies and the actual state of the environment. These deviations accrue over time from employee turnover, mergers and acquisitions, software updates, support exceptions, and troubleshooters who disable settings and forget to restore them.

Periodic, manual reviews can leave these vulnerabilities unnoticed for long periods. Identity hardening involves moving to continuous, automated configuration audits that automatically detect, alert on, or revert unauthorized changes—before attackers can exploit them.

According to the Huntress 2025 Managed ITDR report, 67% of organizations have seen identity-related incidents increase in the past three years, and more than one in three say identity-based attacks now make up over 40% of all their security incidents.

That’s not a blip—it’s the new normal. This isn’t surprising when you consider the growing list of sophisticated identity-based threats, including:

• Session hijacking and browser-layer token theft
• Advanced social engineering, quishing, and pretexting
• Mailbox manipulation and OAuth consent abuse
• Living off the land (LOTL) and valid credential abuse
• Third-party identity compromises and supply chain attacks

Many attackers find it easier and less risky to purchase stolen credentials on the dark web or run an AI-assisted spear-phishing campaign than to develop and deploy a sophisticated exploit. Once inside the environment as a legitimate user, adversaries are much harder to detect, especially if identities are overprivileged or posture gaps make lateral movement trivial.

Once inside the environment as a legitimate user, adversaries are much harder to detect. Every minute an attacker goes undetected is another minute they have to establish persistence, escalate privileges, move laterally, and locate high-value data.

Having the importance of identity hardening explained is one thing. Putting continuous identity hardening into action is another. That ongoing process is the crux of identity hardening, and it’s often where businesses go wrong.

Treating identity settings as a one-time setup

Many organizations treat identity security as a static one-time setup or periodic compliance check. But cloud platforms are highly dynamic, with settings constantly shifting due to platform updates, vendor additions, policy exceptions, and employee turnover. Waiting for the next quarter to address a security gap means it may be exploitable for several months or more.

Leaving inactive accounts and risky defaults in place

Organizations frequently use off-the-shelf software, web applications, and network devices with their factory-default configurations active. These defaults often include well-known administrative passwords and predictable password-recovery questions. Many businesses also hesitate to disable legacy authentication protocols because it may disrupt older, business-critical applications. This leaves serious security gaps exposed. Other times, inactive accounts are allowed to linger simply because IT teams are burdened with more pressing issues.

Lacking ownership for ongoing identity posture

Even when posture monitoring tools are deployed, businesses often fail because they don’t assign clear ownership of identity controls. There should be a defined playbook that details who is responsible for investigating an identity posture alert, who has the authority to revert the change, and when an exception should be formally accepted versus rolled back.

Manually addressing dynamic identity risks continuously isn’t practical, which explains why, according to a Huntress survey, organizations have, on average, 30 known, high-risk misconfigurations waiting to be addressed. Operationalizing this process requires a tool like identity security posture management (ISPM), which works alongside other tools like identity and access management (IAM) to ensure that controls are in place and functioning properly.

Huntress Managed ISPM helps harden Microsoft 365 identities by continuously auditing configurations, enforcing policies, and addressing drift. Because it’s backed by insights from the Huntress SOC, who protect millions of identities, it prioritizes the gaps that we see attackers use most often as their initial point of entry. Learn more about how Managed ISPM guards against identity-based attacks.