Traditional perimeter security assumed that if you protected the network, you protected the organisation. Microsoft 365 has rendered that model obsolete. In a cloud-first world, identity is the perimeter — and attackers know it. This article explores how modern attackers compromise Microsoft 365 tenants and why identity misconfiguration is now the dominant failure mode.