They did not break in. They signed in.
Once an attacker has a valid login, nothing on the endpoint objects and nothing in the firewall log looks wrong. Watching the identity itself is a separate job from watching the machine.
Tagged Microsoft 365
Microsoft 365
The phishing that gets through is the phishing that looks like business
Microsoft 365 filtering catches the obvious. It does not reliably catch an invoice from a supplier whose own account was taken over, which is the attack that actually costs practices money.
The backup you have never restored from is not a backup
A backup job reporting success tells you a job ran. It does not tell you the data comes back. Three things separate a real recovery plan from a green tick in a dashboard.