TL;DR
Cayosoft’s September and October 2026 Guardian updates add new detections for identity and configuration risks across Microsoft Entra, SharePoint Online, Exchange Online, and Active Directory, helping teams identify emerging attack paths and stay current as threats evolve.
Cayosoft’s September and October 2026 threat detection updates add new coverage for Microsoft Entra agent identities without active owners or sponsors, anonymous SharePoint Online sharing, unauthenticated Exchange Online relay, and weak or missing BitLocker policies on Active Directory domain controllers.
These threat definitions are automatically updated for customers using Cayosoft Guardian Protector, Guardian Audit & Restore, and Guardian Instant Forest Recovery, helping teams stay current as identity attack paths and security guidance evolve.
Key Takeaways
- Agent identities require active accountability. Guardian detects Microsoft Entra agent identities without an active owner or sponsor to oversee purpose, permissions, and behavior.
- Microsoft 365 trust settings can create direct attack paths. New September detections identify anonymous SharePoint Online sharing and Exchange Online connectors that allow unauthenticated inbound relay.
- Domain controllers need strong drive encryption. Guardian identifies missing or weak BitLocker policy that could leave critical Active Directory data exposed to offline access.
Microsoft Entra Agent Identities Need Accountable Ownership
CTD-000214: Microsoft Entra agent identity with no active sponsor detects an agent identity whose assigned user sponsors are disabled or otherwise unable to act. The owner manages the technical identity and its configuration, while the sponsor remains accountable for its business purpose, access, and lifecycle.
Why It Matters
Agent identities can hold meaningful permissions and operate at machine speed. Without an active sponsor, there may be no one regularly validating whether the identity is still needed, whether its access remains appropriate, or whether its behavior is expected. If an attacker compromises that identity, existing permissions can be used to access resources and data while suspicious activity receives less scrutiny.
Organizations should treat sponsorship as a core control for agent identity governance: assign an accountable sponsor, verify that the sponsor remains active, review permissions regularly, and retire identities that no longer have a valid business purpose.
Agent Identities Need an Active Owner
CTD-000213: Microsoft Entra ID agent identity with no active owner detects an agent identity with no assigned active owner, including an identity owned only by disabled accounts.
Why It Matters
An owner whose account is disabled cannot sign in, review permissions, or respond to an alert. The agent can continue operating with its original access while no active owner notices configuration drift or unexpected behavior, creating an opportunity for persistence.
Weak Domain Controller Encryption Can Expose Domain Credentials
CTD-000215: AD domain controller without or weak BitLocker drive encryption policy detects domain controllers with no BitLocker policy applied through Group Policy or with policy settings that provide insufficient protection.
Why It Matters
Without strong drive encryption, the Active Directory database (Ntds.dit), SYSVOL, and registry hives may be stored on unencrypted drives, or protected by a weak cipher without recovery information backed up to Active Directory. An attacker with physical access to a server, virtual hard disk, backup, or snapshot could mount the drive offline and potentially extract password hashes for domain accounts, including the krbtgt account.
Real-world example: In a 2024 incident investigated by S-RM, the Akira ransomware group compromised a VMware environment, shut down a virtual domain controller, copied its virtual disk, and extracted the Ntds.dit database and SYSTEM registry hive offline. The recovered credential material helped the attackers escalate privileges and compromise additional systems within hours. The incident shows how properly configured encryption can reduce the risk of offline credential extraction when encryption keys are protected separately from the affected virtualization environment.
Anonymous SharePoint Links Weaken Access Accountability
CTD-000212: SharePoint Online tenant with external sharing set to ‘Anyone’ detects a tenant that permits anonymous, unauthenticated links to files and folders without requiring sign-in.
Why It Matters
Anyone who obtains an anonymous link can open the shared content. The organization cannot reliably verify who used the link or revoke access for a specific identity afterward. Restricting external sharing to new and existing guests, or a more limited level, reduces the impact of a leaked URL. This signature is supported starting with Cayosoft Guardian version 7.4.0.
Unauthenticated Exchange Relay Can Bypass Normal Email Checks
CTD-000211: Exchange Online connector that allows unauthenticated inbound relay detects an inbound connector that accepts email without requiring authentication or a restricted, verified sender IP range.
Why It Matters
A misconfigured connector can allow an external system to relay email through the organization as if it were internal or trusted. A threat actor can use that path to send spoofed or malicious messages that bypass some of the spam and authentication checks applied to ordinary inbound email. Restrict inbound connectors to known sources that are authenticated or IP-restricted.
Related real-world example: In 2022, Microsoft investigated a campaign in which attackers compromised administrator accounts, created malicious OAuth applications, and added inbound Exchange Online connectors. The attackers then used those connectors to send deceptive sweepstakes messages that appeared to originate from the victims’ domains. Although Microsoft did not describe the exact unauthenticated-relay configuration detected by CTD-000211, the investigation shows how control of an inbound connector can turn a trusted tenant into infrastructure for convincing spoofed email.
Stay Current as Identity Risks Change
Identity security is not a one-time assessment. New identity types, configuration weaknesses, and attacker techniques continually create new paths to privileged access. Automatically updated threat definitions help Guardian users detect new risks without waiting for a major product upgrade or manually importing detection content.
Review the Cayosoft Threat Directory to understand the latest detections and recommended remediation guidance. Organizations evaluating continuous identity threat detection can also assess Guardian Protector across Active Directory, Microsoft Entra ID, and Microsoft 365.