A help-desk call can become lasting identity access
Microsoft investigated two intrusions that began with Teams impersonation and user-approved remote support. Attackers then abused misconfigured Active Directory Certificate Services to obtain privileged authentication certificates. One incident exploited a certificate template; the other relayed authentication to web enrollment. Password resets and workstation reimaging alone do not revoke those certificates or existing Kerberos tickets. A containment exclusion left a privileged identity usable in one case, enabling further theft. The operational lesson reaches beyond phishing training: service-desk verification, certificate configuration and identity containment must work together.
Why it matters for leaders
Have the service desk rehearse verification through a known internal channel. Ask the identity owner to review certificate enrollment and containment exclusions, then test a response checklist covering certificates and sessions as well as passwords. Allocate specialist time before declaring recovery complete.
Cost, service, risk & adoption
Microsoft’s October 30 incident analysis documents two distinct attack paths and response outcomes. It attributes neither case to a named actor and does not describe a Teams software vulnerability.
What the evidence cannot tell us
Two vendor-observed cases do not quantify district exposure or prove a specific security product will prevent compromise.
Read the original sources
Summary and leadership analysis from the Week ending 2026-10-30 brief. The edition’s selection notes explain source access and evidence limitations.