With more than half of all global businesses using Microsoft 365, business email compromise is a lucrative target for criminal groups with a seemingly never-ending list of potential victims. Typical methods of compromise include phishing emails, the use of account credentials leaked in data breaches, social engineering, and brute force attacks. Once threat actors have control of accounts, they can send malicious and spam emails, facilitate fraudulent transactions, carry out reconnaissance on the business, and collect personal data that can be used for identity theft or fraud.