Cloud identity systems have become critical to the daily operations of Kenyan organisations.
Microsoft Azure and Entra environments may contain employee accounts, administrators, service accounts, organisational structures and access permissions.
A recent credential-theft campaign demonstrates how attackers can use stolen cloud credentials to extract large employee-directory datasets.
Even where financial information or confidential documents are not immediately stolen, organisational directories provide useful intelligence for phishing, impersonation and attacks against privileged users.
Kenyan organisations should enforce phishing-resistant multi-factor authentication where possible, review privileged accounts, monitor suspicious logins and promptly revoke compromised credentials and active sessions.
Third-party applications connected to cloud identities should also be reviewed to ensure that they have only the permissions they require.
In modern environments, cloud identity has effectively become part of the security perimeter and should be monitored accordingly.