Marta implemented what she called the Three Locks of Aether .

At 2:17 AM, the alert fired again. A new ghost session. But this time, the Conditional Access policy rejected it.

She turned on Conditional Access policies with strict terms. No more trusting a token just because it came from a corporate device. Now, every connection to AVD required a compliant device claim (Intune-managed) AND a sign-in risk check (Microsoft Entra ID Protection). If the user’s behavior was unusual—like logging in from a new country at 3 AM—the session was blocked, even if the password was correct.

Marta smiled. “The cloud isn’t a castle. It’s a river. You can’t build walls. You have to control the flow of trust. Secure the identity. Lock the control plane. And never, ever let the ghost sleep in the gold image.”

The attacker lasted seven minutes. Then they vanished.