Office Home Sign-in from Unmanaged Device Leading to SharePoint/OneDrive Access

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects sign-in activity to the 'Office Home' portal from an unmanaged, non-compliant device, followed by authentication to sensitive cloud services like SharePoint Online, OneDrive, or Microsoft Graph. This pattern often indicates a potential session hijacking or post-compromise activity where an attacker uses an unmanaged device to access enterprise data via cloud application discovery.