A Microsoft 365 session is the authenticated state created after a user signs in to Microsoft 365 services. Instead of checking the password on every request, the platform issues tokens or cookies that let the browser or app keep acting as that user until the session expires, is revoked, or is revalidated.
Sessions matter because attackers often target them directly. If a phisher, malware sample, or token-stealing tool captures a valid session, the attacker may access email, files, and collaboration tools without needing the password again. This can also weaken the protection offered by MFA, since the session may already be trusted by the service. Defenders therefore monitor for unusual sign-ins, enforce conditional access, limit session lifetime, and revoke suspicious sessions quickly. In practice, session control is a core part of cloud identity defense, not just an afterthought to login security.