If your business runs on Microsoft 365, your staff logins are handled by a Microsoft service called Entra ID. This week Microsoft confirmed a flaw in it, tracked as CVE-2026-69836, that carried a severity score of 10.0 – the highest the industry scale goes to.
Two details matter. Microsoft says the flaw was exploited in the wild, which means attackers were actually using it, not just researchers finding it in a lab. Microsoft also says it is now fully mitigated and that no action is required from customers, because the fix went into Microsoft’s own cloud service rather than into software sitting on your computers.
So there is nothing for you to install this time. That is genuinely good news, and it is worth understanding why. When the broken part lives in a cloud platform, the vendor can repair it for every customer at once. When it lives in something you run yourself – an office server, a firewall, a laptop in the back room – nobody repairs it but you. That is where most small business risk actually sits.
The wider point is about where attackers are aiming. Increasingly it is not the clever technical break-in; it is the login. Your Microsoft 365 account is the front door to your email, your files, your invoices and your customer list. That door is the part you control, and there are four things worth checking this week:
- Multi-factor authentication is switched on for every account, including the owner and the IT admin accounts. Those are the ones most often left out.
- Former staff no longer have active accounts. An old login nobody closed is a favourite way in.
- Only one or two people hold full administrator rights, and they use an ordinary account for day-to-day email.
- Someone is actually reading the sign-in alerts. An alert nobody opens is not a control.
This particular flaw needed nothing from you. The next one probably will, and the businesses that come through it well are the ones that already know which accounts they have and who holds the keys.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.