New Alert - Plaintext passwords on one endpoint

Chris Johnson 5 Reputation points
2023-04-21T14:22:12.9333333+00:00

Good morning, We received an alert on an endpoint that we had not seen before: Plaintext passwords on one endpoint We can not find much detail from the alert other than a user may have stored their credentials in plaintext somewhere in Outlook. Has anyone else received a similar alert? If so, what did you do to investigate?

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
4,217 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Catherine Kyalo 655 Reputation points Microsoft Employee
    2024-02-05T08:17:17.29+00:00

    Hi @Chris Johnson The alert "Plaintext passwords on one endpoint" suggests that a user may have stored their credentials in plaintext somewhere in Outlook. To investigate this issue, you can start by checking the user's Outlook settings and saved passwords. It is important to educate the user about the risks of storing passwords in plaintext and encourage them to use a password manager instead. Additionally, you can enable multi-factor authentication (MFA) for the user's account to add an extra layer of security. You may also want to consider implementing Azure AD Password Protection which can help prevent users from using commonly used passwords and can block password spray attacks. More information on Azure AD Password Protection can be found here: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-policy

    0 comments