Adversary Infrastructure is now generally available for every Managed ITDR partner and customer protecting Microsoft 365.
Here’s how it works. When the Huntress SOC confirms the hosting, relay, or proxy infrastructure behind an identity attack in one tenant, our detection engineers validate it against legitimate traffic across the entire fleet. Then we deploy a blocking Conditional Access policy to every eligible, opted-in tenant, the same day. The next attack from that infrastructure fails at sign-in. One partner’s incident becomes every partner’s protection.
What you get with Adversary Infrastructure:
- Blocking at sign-in.Attacks from confirmed adversary infrastructure fail before a token is ever issued.
- Zero policy work.We write each policy, check every tenant daily, repair drift, and update ranges as attackers rotate. You never curate a blocklist or touch Conditional Access.
- Precision.We block only attacker IP ranges with zero legitimate sign-ins across the fleet, so you can stay ahead without country blocks or gateway-only access.
- Proof.Every blocked attempt generates a Low severity incident report naming the targeted identity, source, network, and campaign. Prevention finally has receipts.
The new Adversary Infrastructure dashboard can be found under ITDR in the left nav, at both the account and organization level. It shows:
- How Adversary Infrastructure works
- Incidents and blocked sign-ins at a glance
- Coverage: which tenants are protected, which are ineligible and why, and the campaign policies in force
- A table of every blocked sign-in
Who’s eligible
Blocking policies deploy to Microsoft 365 tenants that meet all four:
- Entra ID P1 or P2 (Business Premium, or E3 with P1, and up)
- Security Defaults turned off
- Tenant healthy in the Huntress portal
- ITDR onboarding complete
Tenants that can’t run Conditional Access still get the same detections and incident reports from the same campaigns, just after the sign-in instead of before. For more info on Conditional Access and Managed ITDR, see How Entra Conditional Access Policies and Huntress Managed ITDR Work Together.
How to opt in
Go to ITDR settings and turn on the Adversary Infrastructure toggle. Set the default at the account level, override it per organization, or enable and disable in bulk.
Existing ITDR partners: opted out by default. Opt in to start receiving policies. Partners onboarded from 11/5/26 forward: opted in by default. Opt out anytime.
What we deploy, and what we never touch
Huntress creates one named location and one blocking policy per campaign. We never edit your policies, named locations, or exclusions. Please don’t hand-edit ours; the daily check reverts changes. Opting out turns our policies off without deleting them, so opting back in takes effect right away.
Adversary Infrastructure is included with Managed ITDR at no extra cost.
Want the full story?
Read our new Adversary Infrastructure blog and join us November 19 for Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In. Register for the livestream.