Stolen passwords and account takeover
Someone signs in with a stolen or guessed password.
- Sign-ins from two places too far apart to travel between, and bursts of wrong passwords.
Microsoft 365
Live
Ojava reads your Microsoft 365 activity logs and warns you about stolen passwords, mail forwarding, risky apps and new administrators.
What it catches
Attacks on the second sign-in step
The attacker has the password and tries to get past MFA or 2-step verification.
- Repeated MFA codes or prompts that Microsoft marks as failed, on every plan. The normal "MFA required" step of a sign-in is not counted.
Mail forwarding and invoice fraud
A hijacked mailbox quietly sends copies of your mail outside: the classic first step of invoice fraud.
- New inbox rules that forward or redirect mail.
Risky app access
Someone gives an unknown app access to mail or files, often after a phishing link.
- Consent to apps asking for sensitive permissions.
New administrator rights
An account suddenly gets admin rights, so an attacker can take over the whole company account.
- Admin roles given to an account.
Mass downloads and data theft
Many files leave in a short time.
- 50 or more downloads from OneDrive or SharePoint within an hour.
Linked attacks
Related warning signs become one incident, so you see the whole story instead of separate alerts.
- For example a sign-in from abroad followed by a new forwarding rule.
What you need
- Any Microsoft 365 business planBusiness Basic, Standard or Premium, E3 or E5, with auditing on (it is on by default). Every alert type works on every plan.
- Faster sign-in alerts with Entra ID P1Included in Business Premium, E3 and E5. Ojava then reads the Entra sign-in log directly: sign-ins usually arrive within minutes, with Microsoft’s location data. Without P1, sign-ins come from the audit log, 60 to 90 minutes after they happen.
- A Microsoft 365 administratorSigns in once to approve Ojava’s read-only access.
How you connect it
- In Ojava: Settings → Integrations → Connect Microsoft 365.
- Sign in as a Microsoft 365 administrator and approve the read-only access.
- Ojava starts reading right away; the first events appear within minutes.
What Ojava reads
Sign-ins (time, IP address, location, app used, success or failure), changes to inbox rules and mail forwarding, app consents and the permissions granted, admin role changes, and file-download records from OneDrive and SharePoint (file name, never the content). Permissions: read-only audit and directory logs (AuditLog.Read.All, Directory.Read.All, User.Read.All, ActivityFeed.Read).
What Ojava never reads
The content of emails, attachments, OneDrive or SharePoint files, Teams chats or calendars. Ojava has no permission to read mail and cannot change anything in your Microsoft 365.
What Ojava sees and never sees, per permission
| Permission (read-only) | What Ojava sees | What Ojava never sees or does |
|---|---|---|
AuditLog.Read.All | Sign-in log entries: who, when, from which IP address and place, with which app, success or failure (Entra ID P1 needed for this log); and the Entra audit log on every plan: changes to sign-in methods (without phone numbers), admin roles, app consents, new users and guests, password resets. | Passwords, mail, files; it cannot sign anyone in or out. |
ActivityFeed.Read (Office 365 Management Activity) | Audit events: inbox and forwarding rules (rule keywords only inside the alert), mailbox delegation, app consents, admin role changes, OneDrive/SharePoint downloads and sharing outside the company (action, count, outside address; file names only inside a mass-sharing alert, at most 20). | The content of emails, attachments, files, Teams chats or calendars. |
Directory.Read.All | Directory facts: users, groups, admin roles and registered apps, to know who is an admin and which app got which permission. | It cannot create, change or delete users, groups, roles or apps. |
User.Read.All | User profiles (name, email address, account enabled or not) to show who an alert is about. | Mailbox content, photos of documents, anything outside the profile. |
openid, profile, email, offline_access | Who approved the connection, and permission to keep reading in the background. | Nothing else. |
How quickly alerts arrive
Ojava reads Microsoft 365 every 5 minutes. Microsoft decides when its logs are available: most audit events 60 to 90 minutes after they happen, Entra sign-ins (with P1) usually within minutes.
The other sources
Windows PCs
Early access: we set it up with youRansomware, malware, password-stealing tools and protection switched off, on each Windows PC. Works with or without Microsoft 365 or Google Workspace.
How it worksGoogle Workspace
LiveStolen passwords, failed 2-step verification, mail forwarding, risky app access, new admins and mass Drive downloads. Every business edition from Business Starter (not personal Gmail accounts).
How it works