Microsoft 365 is a Tier 1 target. Once inside, attackers change Entra roles, weaken conditional access, and disable security controls to persist. That’s why outages drag: you must prove identity, privilege, and tenant policies are clean before you can safely turn the business back on.