On March 11, 2026, one of the world’s largest international companies faced a massive cyber incident: employees across multiple regions turned on their laptops and phones only to discover their devices had been completely wiped. Within just a few hours, nearly 80,000 corporate devices were erased — without ransomware, without malware, and without any zero-day exploits being used.
What makes this case especially alarming is that the attackers relied entirely on legitimate Microsoft 365 and Intune administration tools. In other words, the damage was caused not by malicious software, but by compromised administrative access.
What Happened
According to the investigation, the attackers gained access to an administrator account and then escalated privileges to Global Administrator level. From there, they used Microsoft Intune to send remote wipe commands across the company’s infrastructure.
Because the attackers operated through legitimate administrative tools, traditional antivirus and EDR solutions detected almost nothing. To the security systems, the activity appeared to be normal administrator behavior.
Multi Admin Approval (MAA) is a built-in Intune feature that Microsoft pointed to directly in response to the Stryker breach. It requires a second admin from a designated approver group to sign off before any sensitive action executes.
In a default Intune setup, one admin can wipe any device instantly. One compromised account is all an attacker needs. MAA breaks that single point of failure by holding the action in a queue until a separate approver reviews and approves it.
Think of it as a two-key protocol. One person initiates the request. A second person must turn their key before anything happens.
MSP Recommendations: Layering Your Defenses
1. Enable Multi Admin Approval
If you are a direct customer tenant, configure MAA this week. Cover device wipes, scripts, apps, and configuration policies at minimum. This is Microsoft’s direct recommendation following the Stryker breach.
For MSPs, enable MAA in your internal tenant and encourage customers to enable it in theirs. Understand the GDAP gap, but do not let it stop you from deploying a control that still adds meaningful protection for direct tenant actions.
2. Implement PIM in Your MSP Tenant
Privileged Identity Management (PIM) addresses the root cause of the Stryker attack: standing privileged access. Your technicians should not have permanent Intune Administrator or Global Admin access in your MSP tenant. That tenant connects to every customer environment you manage via GDAP. One compromised tech account with standing GA access is a single point of failure for your entire customer base.
With PIM for Groups configured, technicians request elevation only when needed, for a defined time window, with MFA or approval required to activate. When the window closes, access is removed. A compromised account at 2 AM on a Saturday inherits low privileges, not access to every customer you manage.
3. Govern Your Break Glass Accounts
Every tenant needs break glass accounts: emergency-only admin credentials for when normal access paths fail. Most organizations manage these poorly. Break glass accounts should meet these requirements:
Cloud-only. Not synced from on-prem AD and not a federated identity. These accounts need to work even if your hybrid infrastructure fails.
Excluded from Conditional Access. At least one break glass account must bypass your CA policies so it remains accessible when everything else is locked down.
Monitored with sign-in alerts. Configure audit log alerts to fire immediately any time a break glass account authenticates. Any use outside a declared emergency is worth investigating.
Conclusion:
Attacking Stryker required no malware, zero-day vulnerabilities, or sophisticated techniques. A single compromised administrator account—combined with a platform configured without a secondary control point—was sufficient to destroy 80,000 devices in just three hours.Multiple-administrator approval, PIM capabilities, and proper incident management protocols are all tools available to you right now. None of these require additional budget allocation; they simply demand proper configuration and the discipline to implement them before an incident forces your hand.
Our team recently helped a client successfully defend against hacker attacks by leveraging precisely this approach.
Why This Matters for Businesses
This incident clearly demonstrates that today’s biggest cybersecurity threats are no longer limited to malware. If attackers gain access to a privileged Microsoft 365 account, the consequences can be severe:
- mass device deletion;
- disruption of internal services;
- employees losing access to corporate systems;
- operational downtime;
- potential data exposure.
And in this case, all of it was done using built-in platform functionality.
Common Weak Points Behind These Attacks
Incidents like this often happen because of the same security gaps:
- permanent administrative privileges;
- lack of additional approval for critical actions;
- insufficient control over privileged accounts;
- limited monitoring of administrator activity;
- weak MFA protection against modern phishing techniques.
Final Takeaway
Modern cyberattacks increasingly rely not on breaking systems, but on abusing trusted tools and administrative privileges.
Microsoft 365 provides powerful management capabilities, but when security controls are poorly configured, those same capabilities can become a weapon against the organization itself.
Today, simply enabling MFA is no longer enough. Without proper privilege management, access segmentation, and continuous monitoring of administrative activity, a single compromised account can lead to a large-scale incident.