The next morning: The manager gets his access back, with a full explanation of what happened.
One Sky Solutions
IT services for SMEs
One Sky Case Study
When holding the password doesn't mean holding control
How a small service company, locked out of its own Microsoft 365 environment, regained control in two hours, then successfully overcame an automated intrusion six months later.
The morning when nothing opens up
A small service company that handles sensitive data on a daily basis: a small team, customers who expect deliverables on a fixed date, and personal information they entrust to it. The manager manages the Microsoft 365 environment himself between two client meetings. We are in discussion with him; nothing has been signed yet.
His phone changes hands. Yet it is on this phone that the manager confirms each connection to Microsoft 365, with two-factor authentication: without it, no one can enter, and no one else can open the door. In a service company, an inaccessible email is a customer waiting for a response. We connect to his workstation: his account is locked, and it is the only administrator account in the company. It is by opening one of his browsers that the real story appears, namely an administrator session that remained active indefinitely.
We use this opening while it still exists: created backup account, Microsoft 365 environment unlocked, two-factor authentication reconfigured, window closed. The agreement is signed shortly thereafter, faster than the planned timeline.
Complete resolution. No lost files, no missed deadlines.
The context
Small service company that handles sensitive data, small team, tight deadlines for clients, Microsoft 365 environment managed by the CEO himself.
The situation
Ongoing discussions with OneSky, service offer in preparation, no contract signed.
The problem
The phone is lost, and with it the two-factor authentication: only one administrator has access to the company’s Microsoft 365 environment.
Six measures implemented when we took the keys
Reopening the door was the urgency. The mandate then begins: ensuring that a lost phone, a forgotten session, or a stolen access cannot shut down the company anymore. Each measure below blocks a specific way of losing control.
1
Emergency administrator account
A second key holder, isolated from daily operations: if the executive's phone disappears, the business stays open.
2
Segregation of administrator and user accounts
No one administers the company’s Microsoft 365 environment using the account that is used to navigate and receive their emails: a forgotten session no longer provides the keys.
3
Role-limited privileges
Each employee has access to what their work requires: a compromised account only opens part of the company, never the whole thing.
4
Inventory of authorized devices
Every known device is listed: when an unknown one appears in the environment, access stops before the question.
5
Behavioral surveillance, 24/7
Our tools do not search for known viruses, they look for the abnormal: workstation isolated automatically, human alerted within the minute.
6
Airtight management, zero implicit trust
The environment blocks by default and asks questions afterwards: exhausting for anyone who has never experienced an incident, reassuring for the others.
ⓘ Under Act 25, personal information of customers exposed in an incident may trigger a reporting obligation to the Access to Information Commission and to the individuals concerned, with fines to follow.
Six months later: the new framework passes its test
An alert is issued at 21:00. A post connects to the manager’s account from a country where he is not located. Three things are happening at the same time, and none of them are waiting until morning.
Contain without waiting for authorization
When we call the team, everything is already locked down: the mechanism has acted before us. The manager is not answering; it is late, and we are not waiting to isolate the account.
Understand how they got in
A link, a document, a code to enter. It’s the same mechanism as when you authorize a television to open a broadcast account. Two-factor authentication has never been broken, it has been circumvented, and no notification appeared on the leader’s phone.
Determine whether data has been leaked
This is the part nobody sees: how long the access lasted, what was viewed, copied, transferred. When an intrusion was the work of a human, we measured it in hours. With automated scripts, we measure it in seconds.
Phase 1
9:00 PM: Alert received, account already isolated by the mechanism, team mobilized.
Phase 2
During the night: Sessions revoked, device ejected, every minute of access traced.
Phase 3
Result: content even before the first call
The intrusion was automated: a program had logged into the account, and the person behind the attack had not yet taken over. No data was leaked, no action was taken in the environment, no client deadlines were missed. Two incidents in six months, two outcomes: the first required a two-hour emergency intervention, the second was contained even before we picked up the phone.
✓ No exfiltration ✓ No action taken ✓ No missed deadlines
What service company leaders need to remember
signal 1
Two-factor authentication is no longer the end goal
That’s the minimum. The methods that bypass it don’t need to be broken; they go right through it. What protects you is knowing what’s normal in your environment and reacting when it’s no longer normal.
signal 2
A single administrator is a single point of failure
If the leader’s phone goes missing tomorrow morning, who opens the door? In most service companies, the honest answer is: no one. A second keyholder takes a few minutes to create it.
signal 3
With Law 25, knowing becomes an obligation
An incident presenting a risk of serious injury must be reported to the Commission d'accès à l'information. Knowing whether data has been leaked, and demonstrating it, is part of the response, not an optional report.
⚠ An administrator session left open in a browser does not trigger any alerts and does not appear in any reports. It stays open until someone finds it, and that is not always you.
✕ A password and two-factor authentication give you access. They do not give you control over your environment, nor the ability to prove what happened there.
Evaluate your posture before an incident reveals it to you
Our worry-free IT package integrates all of these practices right from onboarding, not after the first incident.
Emergency administrator accounts
Never another single point of failure: access remains guaranteed even if the executive's phone disappears.
Privilege separation
Every employee accesses what they need, and administrator accounts remain separate from daily operations.
Continuous behavioral monitoring
Our tools detect what is not normal, 24/7, and isolate the workstation before the damage is done.
Ready to take action?
An initial audit, with no obligation: who holds the administrator keys for your company, how many devices are allowed in your environment, and what happens to your customers if your phone goes missing tomorrow morning.