The login is valid. The behaviour isn’t.
Today’s attackers don’t break in. They log in. Our Identity Threat Detection and Response (ITDR) service monitors Microsoft 365 identity activity to spot suspicious behaviour behind valid logins, investigates high-risk activity and guides a fast response, before a compromised account becomes a costly breach.
There’s no malware to quarantine. The sign-in succeeded, so the attacker can read email, download files and study payment processes using a trusted employee’s access.
Phishing and credential harvesting remains one of the most commonly reported cyber incident categories in New Zealand, according to the National Cyber Security Centre. Every stolen password is a potential account takeover.
Contact us today to learn more about Identity Threat Detection and Response and how we can help protect your Microsoft 365 accounts.
MFA protects the login. ITDR watches what happens next. Our service continuously monitors sign-in and session activity across Microsoft 365 and Microsoft Entra ID, flagging impossible travel, unfamiliar devices and IP addresses, token reuse, suspicious inbox rules and external forwarding.
High-risk detections are triaged and investigated by our security specialists, with confirmed or material threats escalated with recommended response actions. You receive a clear finding and recommended response, from revoking sessions and resetting credentials to removing malicious rules and apps.
Book a consultation to learn how Identity Threat Detection and Response fits your cyber security strategy.
Surfaces suspicious sign-ins and identity activity early, helping reduce the time an attacker can operate through a compromised account.
ITDR surfaces suspicious inbox rules, external forwarding and risky OAuth apps that keep attackers inside.
Our security specialists investigate high-risk activity, so your team only hears about what matters.
Plain-English findings with recommended actions: revoke sessions, reset credentials, remove malicious rules or apps.
Shows insurers, auditors and your board how you detect and respond to account takeover.
CodeBlue has been supporting New Zealand businesses for over two decades. We’re part of FUJIFILM Business Innovation, which gives us the scale and systems of a larger provider – alongside a strong local presence and a genuine understanding of the Kiwi market.
With over 300 organisations supported across the country, our team of cyber experts have extensive experience in implementing and managing cyber security strategies for Kiwi SMBs.
We don’t lock clients into long-term contracts. Instead, we focus on building long- term trust through transparency, responsiveness, and consistent results.
Identity Threat Detection and Response (ITDR) is a security service that detects, investigates and responds to attacks on user accounts. Instead of looking for malware, it monitors how identities behave (sign-ins, sessions, app permissions and mailbox changes) to expose attackers who are using real, valid credentials.
No. MFA is a preventive control that checks who is signing in, and it remains essential. ITDR is a detection and response control that watches what happens around and after the sign-in. Together they stop more attacks: MFA blocks most password-only attempts, and ITDR catches the ones that get past it.
Yes. Adversary-in-the-middle (AiTM) phishing, session token theft, MFA fatigue and malicious OAuth consent can all give an attacker access without defeating MFA directly. ITDR detects the unusual behaviour these techniques leave behind, such as an authenticated session suddenly used from another country or device.
ITDR helps detect impossible travel (sign-ins from two locations too far apart to travel between in the time elapsed), sign-ins from unusual locations, devices or IP addresses, session hijacking, credential theft, suspicious inbox rules, unauthorised email forwarding and risky or over-permissioned OAuth applications in Microsoft 365.
Most BEC attacks start with a compromised mailbox. Attackers sign in with stolen credentials, create hidden inbox rules or forwarding, then wait for an invoice or payment conversation to hijack. ITDR detects the suspicious sign-in and mailbox changes early, so the account can be contained before money moves.
Microsoft 365 and Microsoft Entra ID generate useful identity risk signals, but signals only help if someone reviews, investigates and acts on them quickly. Most small and mid-sized businesses don’t have a security analyst doing this. ITDR adds the people and process that turn Microsoft’s alerts into confirmed findings and clear response actions.
MDR primarily detects malicious activity on the endpoints and workloads covered by the MDR service. ITDR focuses specifically on identity and Microsoft 365 activity, including sign-ins, sessions, mailbox changes and cloud permissions. Together they provide visibility across both devices and identities.
Advanced Mail Filtering works at the email gateway to stop phishing and malicious messages before they reach the inbox. ITDR assumes some attacks will still succeed and watches for the account compromise that follows, such as a stolen session or a new forwarding rule. One reduces the chance of compromise; the other limits the damage.
High-risk activity is reviewed and triaged by CodeBlue’s security team. Depending on severity, recommended response actions may include revoking active sessions, resetting passwords and MFA methods, disabling the account, removing malicious inbox rules or apps, and investigating what the attacker accessed.
Yes. Identity attacks are often automated and target organisations of every size. Many New Zealand SMBs run on Microsoft 365 but have no dedicated security team monitoring identity activity. A managed ITDR service provides specialist monitoring and response without the cost of hiring in-house security staff.
