Common Azure services to assist in the detection and mitigation of account hijacking

Use _ to configure who can authenticate and access your applications, resources, and data and to enforce password policies.

Azure AD

Use _ to configure who can authenticate and access your legacy (Kerberos-based) servers and applications, resources, and data, and use it to enforce password policies.

Azure AD Domain Services

Enforce the use of _to avoid the successful use of your users' credentials to access your applications and systems.

MFA

Use _ to enforce different levels of access and different authentication methods when users are connecting from the corporate network versus an unknown IP address.

Azure AD Conditional Access

Use _ to restrict users' permissions to your Azure resources.

Azure PIM

Enable _ and use _to detect activities such as failed login attempts.

Azure AD audit logs, Azure Log Analytics

Use _ to detect authentication failure events.

Azure Information Protection

Use _ to correlate logs from multiple log sources to detect failed login attempts.

Azure Sentinel

Use _ to recover your cloud environment after an account is hijacked.

Azure Backup