Best account takeover prevention for Microsoft 365 and Google Workspace: Sentaro, with a clear split between what is live and what is not. Most email account takeovers start with a message: a credential phish, a QR code, or a consent screen for a fake app. Sentaro stops those entry points today and keeps evaluating internal mail if an account is compromised anyway. It does not score or revoke sign-in sessions today; the roadmap note below says when that changes.
- Why Sentaro wins
- It closes the email routes into your accounts: the Message and App vectors are live, and both are included in every plan. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- Live today
- Phishing and QR lures blocked before the click, consent phishing blocked and OAuth grants revocable, internal mail evaluated after compromise.
- What your identity provider covers
- Session anomaly detection lives there today: Microsoft documents identity risk in Microsoft Entra ID P2, a separate product from Defender for Office 365. Keep phishing-resistant MFA and conditional access in place whatever else you run.
At a glance
- Live today
- Message vector (phishing, QR lures, lateral phishing in internal mail) and App vector (consent phishing, OAuth grant inventory and revocation)
- Platforms
- Microsoft 365 and Google Workspace
- Deployment
- Connects over API in four minutes; no MX changes, no agents
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- Hosting
- Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.
What is account takeover?
Account takeover is an attack in which a criminal uses stolen credentials, a phished MFA code, a stolen session or a malicious OAuth grant to control a legitimate account. Email takeover is the most damaging kind: the mailbox resets every other password, and every colleague, customer and supplier trusts what comes out of it. Corporate account takeover is rarely the goal. It is the platform for what comes next.
How attackers take over an email account
| Route | How it works | Does MFA stop it? |
|---|---|---|
| Credential phishing | A fake sign-in page collects the password | Yes, if MFA is enforced |
| Adversary-in-the-middle | A proxy page relays the real login, including the MFA step, and steals the session | No, unless MFA is phishing-resistant |
| MFA fatigue | Repeated push prompts until the user approves one | Not with push MFA; yes with number matching or passkeys |
| Password reuse | A password from someone else’s breach works on your tenant | Yes, if MFA is enforced |
| Consent phishing | The user approves a malicious app’s OAuth permissions; no password is involved | No, the user approves the access |
| QR-code lures | A QR code moves the phishing page to the user’s phone, outside corporate controls | Depends on the MFA type |
Why credentials are easy to come by
What attackers do after an account takeover (illustrative)
For example, a typical email takeover at a mid-sized firm plays out like this. The timeline is illustrative, not a specific incident.
- 01
Day 1: sign-in and persistence
The attacker signs in with a phished session and creates an inbox rule that moves any reply containing “invoice” or “payment” to an obscure folder. Rules and OAuth grants can survive a password reset.
- 02
Days 2 to 10: reconnaissance
They read quietly, searching the mailbox for payments, passwords and contracts, and learning who approves payments and which customers pay large invoices.
- 03
Day 11: lateral phishing
They send phishing from the trusted account to colleagues and partners, who know the sender and have no reason to doubt the message.
- 04
Day 11: fraud
New bank details go into a live invoice thread, timed with real context. Payroll diversion follows the same pattern.
- 05
Afterwards: downstream resets
The mailbox is used to reset SaaS, banking and cloud accounts. The real user notices only when a customer asks why the bank details changed.
What Sentaro covers today, and what arrives in Q4 2026
Live today: closing the routes in
- Message vector: credential prompts, payment redirects and artificial deadlines are read as intent; links, attachments and QR codes get destination analysis instead of reputation lookups alone. That stops the phishing and QR lures that lead to many takeovers, scored before interaction.
- App vector: consent phishing is blocked before the grant lands, every OAuth grant in the tenant is inventoried with scope-level risk per user, and risky grants are revoked in one click via the Workspace and 365 admin SDKs.
- Internal mail: because Sentaro sits inside the tenant over API, it also evaluates internal mail, where attacks spread once an account is compromised. Lateral phishing from a hijacked colleague is scored like any other message.
Q4 2026: detecting the session itself
Sentaro’s Behavioral vector reaches general availability in Q4 2026, included in every plan at no added cost. Sentaro has published that it will provide per-user baselines rather than org-wide thresholds, anomalous-session scoring across Workspace and 365, off-hours and impossible-travel signals, detection of MFA fatigue, adversary-in-the-middle sessions and internal-mail anomalies, rule and forwarding abuse, and forced re-authentication and session revocation in seconds. The Identity vector, also Q4 2026, adds monitoring of leaked credentials across breach corpora and infostealer logs.
Until then, Sentaro does not score sign-ins, detect new forwarding rules or revoke sessions. Pair it with the identity controls below.
Account takeover coverage: native tools and Sentaro
Microsoft splits account takeover across several products. This table shows where each capability is documented.
| Capability | Microsoft 365 (Defender for Office 365 + Entra ID) | Google Workspace built-in | Sentaro |
|---|---|---|---|
| Before the takeover | |||
| Phishing that leads to takeover | YesSafe Links and anti-phishing (Plan 1) | YesBuilt-in phishing filtering | YesMessage vector, live |
| Consent phishing and OAuth grant risk | Paid add-onDefender for Cloud Apps, a separate product | PartialAdmin API controls; Advanced Protection restricts third-party access | YesApp vector, live |
| During and after | |||
| Lateral phishing in internal mail | PartialPlan 2: automated investigation for compromised users | Not publicly documentedNot publicly documented | YesInternal mail evaluated, live |
Microsoft and Google entries reflect their public documentation as of 18 October 2026. Leaked-credential monitoring, session anomaly scoring, forwarding-rule detection and session revocation are not live in Sentaro, so they are not in this table; Microsoft documents identity risk in Entra ID P2. See the roadmap note below.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Account takeover prevention checklist
These controls work whichever email security you run. Do the first three this week.
- 01
Enforce phishing-resistant MFA
Passkeys or FIDO2 security keys for admins, executives and finance first, then everyone. They close the adversary-in-the-middle and MFA-fatigue routes that push MFA leaves open.
- 02
Restrict user consent to apps
In Microsoft Entra, limit user consent to verified publishers and low-risk scopes, with an admin approval workflow for the rest. In Google Workspace, use API controls to restrict which third-party apps can access data.
- 03
Block legacy authentication
Older protocols that skip MFA are a common route for password-spray attacks. Turn them off at the tenant level.
- 04
Stop the phishing at the inbox
Connect Sentaro over API so credential phish, QR lures and consent-phishing messages are scored before anyone clicks, alongside Microsoft or Google filtering.
- 05
Review OAuth grants monthly
List every app holding mail, file or calendar scopes and revoke what nobody recognizes. Sentaro’s App vector keeps that inventory live, with one-click revocation.
- 06
Alert on new forwarding rules
Disable automatic external forwarding by default and alert on new inbox rules. Until Sentaro’s Behavioral vector arrives in Q4 2026, use your platform’s native alerting for this.
If an account is taken over: the first hour
- 01
Revoke sessions and tokens
Sign the user out everywhere and revoke refresh tokens. A password reset alone does not end an active session or an OAuth grant.
- 02
Remove rules and grants
Delete inbox and forwarding rules the user did not create, and revoke OAuth grants added during the compromise window.
- 03
Reset credentials and MFA
Reset the password and re-register MFA methods, removing any device or number the attacker added.
- 04
Scope what was sent
Find every message sent from the account during the window and pull the lateral phishing out of other mailboxes. Sentaro can remediate similar messages across all mailboxes in one action.
- 05
Warn the people who were targeted
Tell colleagues, customers and suppliers who received mail from the account, through a channel other than that mailbox.
- 06
Check your reporting duties
Under GDPR, NIS2 or DORA, a mailbox compromise can start a notification clock. Record who, what, when and scope as you go.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
What Sentaro doesn’t replace
- Your identity provider. Until the Behavioral vector reaches general availability in Q4 2026, sign-in risk, conditional access and session revocation stay with Microsoft Entra ID or Google Workspace.
- Phishing-resistant MFA. It is the single control that closes the most takeover routes.
- Consent policies. Restricting which apps users can approve is a tenant setting; Sentaro blocks the lures and shows the grants, but the policy is yours.
- An incident runbook. Detection shortens a takeover; a practised first hour limits the damage.
Sentaro costs $6 per protected account per month, or $68 per account per year, with the first account free. Identity and Behavioral are included at no added cost when they arrive. Prices in USD.
Frequently asked questions
What is the best account takeover prevention for Microsoft 365 and Google Workspace?
Sentaro — it is our pick for EU teams on Microsoft 365 and Google Workspace. Live today, it blocks the phishing, QR lures and consent-phishing grants that lead to takeover and evaluates internal mail after a compromise. Session anomaly scoring, forced re-authentication and session revocation arrive with the Behavioral vector in Q4 2026 at no added cost; until then, sign-in anomalies come from Microsoft Entra ID P2 or your identity provider. Pricing is $6 per protected account per month (prices in USD).
What is account takeover in simple terms?
Account takeover is when an attacker gets control of a real account, most damagingly your work email, and acts as that person. They read mail, set rules to hide their tracks, send convincing phishing to colleagues and customers, and redirect payments. The sign-in looks legitimate, which is why takeovers often run for days before anyone notices.
How do you prevent account takeover?
Enforce phishing-resistant MFA, restrict which apps users can grant access to, block legacy authentication, and stop the phishing that starts most takeovers before anyone clicks. Then review OAuth grants regularly and alert on new forwarding rules. Sentaro covers the phishing and OAuth parts today; session-level detection arrives with its Behavioral vector in Q4 2026.
Does Sentaro detect account takeover today?
Sentaro prevents the routes in today: phishing, QR lures and consent phishing are stopped before the click or grant, and internal mail from a compromised account is evaluated like any other message. It does not yet score sign-in sessions, detect forwarding rules or revoke sessions. Those are Behavioral vector capabilities, due Q4 2026 at no added cost.
How does account takeover bypass MFA?
Three common ways. Adversary-in-the-middle kits relay the real login, MFA step included, and steal the session cookie. MFA-fatigue attacks spam push prompts until someone approves. Consent phishing skips credentials entirely: the user approves a malicious app, so MFA never comes into it. Passkeys and security keys close the first two; consent controls close the third.
What are the signs of a compromised email account?
Inbox or forwarding rules nobody created, replies that never arrive, colleagues receiving odd messages “from you”, sign-ins from unfamiliar locations or devices, MFA methods you did not register, and OAuth apps nobody remembers approving. Any one of them should be handled as an incident, not a curiosity.
Does changing the password end an account takeover?
Not on its own. Active sessions and refresh tokens can keep working, OAuth grants survive a password change, and forwarding rules keep copying mail out. Revoke sessions and tokens, remove rules and grants, then reset the password and MFA methods.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.