Sweet Deception: Designing Effective M365 Honey Tokens

Name: Sweet Deception: Designing Effective M365 Honey Tokens
Duration: 45 min
Description: Competent, practitioner-focused talk on deploying M365 canary tokens using hidden mailbox folders and MailItemsAccessed filtering — useful, implementable, and grounded in real deployment data. The core technique isn't novel to anyone who's played with Thinkst or done M365 forensics work, but the native-only angle and the concrete four-week trial data elevate it above a blog post.

Ryan O'Donnell

Cloud Village @ DEF CON 33 · Day 1 · Cloud Village

AI review

Competent, practitioner-focused talk on deploying M365 canary tokens using hidden mailbox folders and MailItemsAccessed filtering — useful, implementable, and grounded in real deployment data. The core technique isn't novel to anyone who's played with Thinkst or done M365 forensics work, but the native-only angle and the concrete four-week trial data elevate it above a blog post.

Watch on YouTube