Where this offering fits
Account Takeover Protection is an investigation and response scope around potentially compromised accounts. It is distinct from filtering incoming messages because the account may already be authenticated. Define the signals, connected services and permitted containment actions with the identity and mail owners.
Architecture and rollout decisions
Use supported integrations and authorised test activity to validate alert context. Decide who can revoke sessions, reset credentials or change access, and how legitimate users recover. Include unusual but valid travel or working patterns in the review. Acceptance should follow an alert through investigation to an approved response, retaining enough evidence to explain the decision.
An evaluation scenario for this offering
Create an authorised account-risk test and a benign unusual-access example. Have the analyst compare evidence and follow the approved identity escalation route. Validate the user’s recovery after any permitted session or credential action. The outcome should identify which team decides that compromise is established and which team restores access. It should not treat travel or unusual hours as wrongdoing, or turn an uncertain signal into an automatically justified account lockout.
Evidence to request for this scope
- Confirm supported account platforms and required permissions.
- Test escalation to identity administrators and user support.
- Record the authority for each disruptive response action.