[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSWIBOUzy1fgN5VSQloZ1h0EMfONMq2bXjAUCJvIe6Yk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":31,"created_at":32,"published_at":33,"article":34,"tags":38,"podcasts":51,"controls":52},"ba63f93b-af01-483e-8378-b9c3e8796b74","ghost-service-accounts-expose-m365-environments-to-data-theft","2a018a8e-b3b9-4d88-8abe-65e826770812","Ghost Service Accounts Expose M365 Environments to Data Theft","The root cause of this threat is the failure to properly manage and decommission service accounts throughout their lifecycle, leaving 'ghost' accounts with persistent access to sensitive Microsoft 365 data long after they are needed. Unlike human user accounts, service accounts are frequently excluded from standard offboarding and audit processes, creating invisible attack surfaces that threat actors can exploit. This matters because a single overlooked service account can grant broad access to organizational data, bypassing all user-level security controls that have been carefully implemented. The Chile incidents demonstrate that identity hygiene is not just about active employees — every privileged identity, human or non-human, must be continuously governed.","**Immediate actions:**\n- Conduct a full audit of all M365 service accounts and immediately disable or remove any that lack a verified, active business owner.\n- Revoke and rotate credentials for all service accounts that have not been reviewed within the past 90 days.\n\n**Long-term improvements:**\n- Implement a formal identity lifecycle management policy that explicitly covers service and non-human accounts, including scheduled access reviews.\n- Integrate service account discovery and governance into the employee offboarding and project decommissioning workflows.\n- Apply the principle of least privilege to all service accounts, restricting permissions to only the minimum required resources.\n\n**Detection measures:**\n- Enable Microsoft 365 Unified Audit Logging and configure alerts for unusual data access or bulk download activity originating from service accounts.\n- Deploy a Privileged Access Management (PAM) solution to continuously monitor, record, and alert on service account usage and privilege escalation.",[12,13,14,15,16,17,18,19,20],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-4 (Identifier Management)","NIST CSF PR.AC-1 (Identities and credentials are managed)","ISO\u002FIEC 27001 A.9.2 – User Access Management","GDPR Article 32 – Security of Processing (access control obligations)","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts",{"CIS Control 5 – Account Management":22,"NIST SP 800-53 AC-6 (Least Privilege)":23,"NIST SP 800-53 AC-2 (Account Management)":24,"CIS Control 6 – Access Control Management":25,"NIST SP 800-53 IA-4 (Identifier Management)":26,"ISO\u002FIEC 27001 A.9.2 – User Access Management":27,"MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts":28,"NIST CSF PR.AC-1 (Identities and credentials are managed)":29,"GDPR Article 32 – Security of Processing (access control obligations)":30},"Account management means inventorying and disabling service accounts when no longer needed, preventing ghost accounts in M365.","Least privilege limits what ghost service accounts can reach, reducing the impact if one is abused.","Account management includes regular reviews and removal of unused accounts, covering service accounts often missed in offboarding.","Access control management ensures service accounts have only the access they need and are reviewed regularly.","Managing identifiers through their lifecycle ensures service account identities are retired when their purpose ends.","User access management covers provisioning, review and removal, which must include non-human service accounts.","Attackers use valid cloud accounts, so ghost service accounts with standing M365 access are attractive targets for abuse.","Managing identities and credentials includes service accounts, so ghost accounts are not left with standing access.","Appropriate access control measures are required to protect personal data in M365, including controlling service account access.","published","2026-09-24T19:20:31.574434+00:00","2026-09-24T19:20:31.202+00:00",{"id":7,"url":35,"slug":36,"title":37},"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fghost-service-accounts-m365-data-theft-chile","ghost-service-accounts-enable-m365-data-theft-in-chile-75c374","Ghost Service Accounts Enable M365 Data Theft in Chile",[39,45],{"id":40,"name":41,"slug":42,"description":43,"color":44},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":46,"name":47,"slug":48,"description":49,"color":50},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[53,57,61],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":58,"name":59,"problem":60},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":62,"name":63,"problem":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]