Because if you can access a virtual desktop from a beach in Bali, so can a threat actor—if they steal the right key.
Frustrated, the attacker pivoted. They tried to deploy a new session host directly via the Azure API. But Marta had locked down the with Azure Privileged Identity Management (PIM) . You couldn’t spin up a host without a time-bound, approved, audited elevation request.
“They’re not asleep,” she muttered, pulling up the Intune device compliance report. “They’re the bait.”