So, I think, we need to demand more from giants like Microsoft and create a project to enforce behavior when our digital and business lives depend on these accounts. I will start with a few suggestions:
1. Violating in one service should not shut down access across the board - authorization may not work for the violated service, but authentication should continue to work so, let's say, sending spam in Outlook (which I didn't do) should not lock you out of Azure.
2. Paying customers should not be suspended without a hotline and SLA to unsuspend them. For example, when my account gets suspended, I should have a unique ticket number, which could be used to call a direct line with, and talk to a 24x7 team to unsuspend my account!
3. When the account is unsuspended, it should be given a grace period and not be suspended again - mistakes happen especially when AI and rich policies are at play and the customer should not suffer repeatedly by them in short periods of time. Once unsuspended, an account should be suspended for a 30, 60, or 90-day period.
4. Each suspension should have a solid proof. Again, we're talking about well-established paying customers. Most hackers and most hijacked accounts are free.
5. The above privileges may require 2FA (which I have!)
6. Suspension of well-established customers should be tracked and stats for it should be published.
7. Every wrong suspension should double up the grace period or be compensated in some form.
Add your feedback!