Unusual sign-in locations
We flag sign-ins from unusual locations or IP addresses. A sign-in from an unexpected place can mean someone else has a staff member's password.
Microsoft 365 security
Microsoft 365 security monitoring from FunctionOne
Attackers take over a Microsoft 365 account by signing in with a stolen or guessed password, then quietly changing mailbox rules and settings. FunctionOne's Microsoft 365 security monitoring flags sign-ins from unusual locations, repeated password attempts, unauthorized mailbox access and new external forwarding rules. Our analysts watch 24/7 and can disable the account or require a password reset within rules you approve.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What does FunctionOne Microsoft 365 security monitoring catch?
FunctionOne, with offices in Syracuse, New York and Tampa, Florida, has security analysts who watch your Microsoft 365 accounts 24/7 and act only within response rules you approve.
Repeated password attempts
We flag repeated password attempts against your accounts. Analysts confirm the activity before acting within your approved rules.
Unauthorized mailbox access
We flag mailbox access by people who shouldn't have it.
New external forwarding rules
We flag new rules that forward company mail to outside addresses. An email forwarding rule attack uses these rules to move mail out.
Multifactor sign-in changes
We watch for changes to multifactor sign-in settings and user permissions. A quiet change to who can sign in, or what they can reach, gets a second look.
Security and app settings
We watch changes to security settings and application permissions.
Account containment steps
Within the response rules you approve, we can disable the account or require a password reset.
Findings for named contacts
We send findings and next steps to the named contacts your organization chooses. Leadership also gets a monthly summary and a regular security review.
Why does FunctionOne watch Microsoft 365 accounts so closely?
Microsoft Learn's 2026 guide, Plan for mandatory Microsoft Entra multifactor authentication, says multifactor authentication can block more than 99.2% of account compromise attacks. That figure leaves a small share of attacks that still get through. We pair multifactor sign-in with stolen password alerts and analysts who watch sign-ins 24/7.
Microsoft Learn's 2026 page, Respond to a compromised email account in Microsoft 365, lists the warning signs of a compromised mailbox: inbox rules that forward to unknown addresses or move mail to Notes, Junk Email or RSS folders, unexplained sent or deleted items, and newly added external forwarding. FunctionOne flags new external forwarding rules and unauthorized mailbox access, then sends findings and next steps to your named contacts.
CISA's 2025 M365 Secure Configuration Baseline for Exchange Online has automatic forwarding to external domains disabled and mailbox auditing enabled. We watch changes to security settings and permissions across your Microsoft 365 accounts.
How does FunctionOne start Microsoft 365 security monitoring?
FunctionOne starts with a security assessment and switches nothing on until you approve the scope and response rules.
Security assessment first
We review your systems and accounts, including Microsoft 365, before anything is switched on.
Agree scope and rules
Your leaders and our team agree on what we monitor and which response rules our analysts may follow.
Watch sign-ins 24/7
Security analysts watch connected systems around the clock. They flag unusual sign-ins, repeated password attempts, unauthorized mailbox access and new external forwarding rules.
Act within approved rules
When an account shows signs of takeover, analysts can disable it or require a password reset.
Report to named contacts
Findings and next steps go to the contacts you named. Leadership also gets a monthly summary and a regular security review.
Which Microsoft 365 takeover signs does FunctionOne flag?
Leaders can use this table to see what FunctionOne watches and how analysts respond.
| Warning sign | What FunctionOne does |
|---|---|
| Sign-in from an unusual location or IP address | Flags it and, within approved rules, can disable the account |
| Repeated password attempts | Flags them and can require a password reset |
| Unauthorized mailbox access | Flags it and can disable the account |
| New external forwarding rule | Flags it and sends findings to named contacts |
| Changes to multifactor sign-in or security settings | Watches the change and reports next steps |
| New permissions or application permissions | Watches the change and reports next steps to named contacts |
Who is FunctionOne's Microsoft 365 security for?
FunctionOne works with established mid-size and large organizations that have outgrown a help desk.
Leaders who report upward
Owners and executives who answer to a board, insurer, auditor or parent company get a monthly summary and a regular security review.
IT directors with teams
FunctionOne can work co-managed beside your in-house IT team. Our analysts act only within the response rules you approve.
Organizations with several offices
FunctionOne runs offices, laptops, phones, servers and cloud from one control point, with security part of everyday IT work.
Microsoft 365 security questions for FunctionOne
How does a Microsoft 365 account get taken over?
A Microsoft 365 account is taken over when someone else signs in with the user's credentials. Microsoft Learn's 2026 page, What are risk detections? Microsoft Entra ID Protection, lists password spray, attacker in the middle and atypical travel as detections. FunctionOne flags repeated password attempts and unusual sign-ins.
What does FunctionOne monitor in Microsoft 365?
FunctionOne flags sign-ins from unusual locations or IP addresses, repeated password attempts, unauthorized mailbox access and new external forwarding rules. We also track changes to multifactor sign-in, permissions, security settings and application permissions. Our security analysts watch connected systems 24/7.
What is an email forwarding rule attack?
A forwarding rule attack sends a user's mail to an outside address. Microsoft Learn's 2026 guide, Respond to a compromised email account in Microsoft 365, names inbox rules that forward to unknown addresses and newly added external forwarding as warning signs. FunctionOne flags new external forwarding rules.
Does multifactor authentication stop Microsoft 365 account takeover?
Multifactor authentication helps, but it can't stop all takeovers. Microsoft Learn's 2026 page, Plan for mandatory Microsoft Entra multifactor authentication, says it can block more than 99.2% of account compromise attacks. FunctionOne also watches changes to multifactor sign-in.
What happens when FunctionOne spots a compromised account?
FunctionOne acts within the response rules your organization approved. Analysts can disable the account or require a password reset. They then send findings and next steps to your named contacts.
Can FunctionOne work with our in-house IT team?
Yes, FunctionOne offers co-managed IT beside an in-house IT team, or fully managed IT. In both setups, security analysts watch connected systems 24/7 and act only within the response rules your leaders approve. Leadership gets a monthly summary and a regular security review.
What forwarding settings does CISA recommend for Microsoft 365?
CISA's 2025 M365 Secure Configuration Baseline for Exchange Online has automatic forwarding to external domains disabled and mailbox auditing enabled. FunctionOne's security assessment reviews your systems and accounts before anything is switched on.
Sources
- Microsoft Learn, Plan for mandatory Microsoft Entra multifactor authentication, 2026
- Microsoft Learn, Respond to a compromised email account in Microsoft 365, 2026
- CISA, M365 Secure Configuration Baseline for Exchange Online, 2025
- Microsoft Learn, What are risk detections? Microsoft Entra ID Protection, 2026