Turning on multi-factor authentication (MFA) is still the single most effective step a business can take to protect email. It blocks the vast majority of password-guessing and password-reuse attacks. But attackers have adapted, and many of the Microsoft 365 break-ins we now see happened to accounts that already had MFA switched on.
The good news is that closing those gaps does not require an enterprise budget. It mostly means using settings that are already included in the Microsoft 365 plans most small businesses pay for.
How attackers get past basic MFA
- Push fatigue. The attacker already has the password and triggers sign-in prompt after sign-in prompt, often late at night, until a tired user taps "Approve" to make it stop.
- Fake sign-in pages that pass MFA through. A phishing email leads to a page that looks exactly like the Microsoft login. It quietly relays everything to the real site, including the MFA code, and captures the session cookie that comes back. With that cookie, the attacker is signed in without needing the password or MFA again.
- Help desk impersonation. A caller pretends to be an employee who has a new phone and asks for MFA to be reset.
- Old protocols. Legacy sign-in methods used by very old mail apps and devices do not support MFA at all, and attackers try them specifically.
What to change
- Use number matching, not "Approve / Deny". Microsoft Authenticator now asks users to type a number shown on the sign-in screen. Make sure everyone is using the Authenticator app rather than text messages or phone calls, which are easier to intercept.
- Move key accounts to phishing-resistant sign-in. Passkeys, FIDO2 security keys and Windows Hello for Business only work on the real Microsoft site, so a fake login page gets nothing useful. Start with administrators, owners and anyone who approves payments.
- Use Conditional Access if you have it. Microsoft 365 Business Premium includes Conditional Access, which lets you require compliant company devices, block sign-ins from countries you never work from and demand stronger authentication for admin roles. If you are on a lower plan, at least make sure Security Defaults are on.
- Block legacy authentication. Very few businesses still need it, and leaving it open undermines everything else.
- Separate admin accounts. Global administrators should use a dedicated admin account that is not used for daily email or browsing.
- Verify before resetting MFA. Any request to reset MFA or change a phone number should be confirmed by calling the person back on a number you already have, never the number the caller gives you.
Signs an account may already be compromised
- New inbox rules that move, delete or forward messages, especially rules with odd names such as "." or "..".
- Sign-ins from unfamiliar locations or devices in the Microsoft 365 sign-in logs.
- Contacts saying they received strange emails or invoices from the user.
- MFA prompts the user did not trigger.
If you see any of these, reset the password, revoke all active sessions for the user, remove unknown inbox rules and MFA methods, and review what was sent from the mailbox. Our article on invoice fraud and business email compromise explains why a hijacked mailbox is often used to redirect payments.
Keep it practical for staff
Security that gets in the way gets bypassed. Passkeys and Windows Hello are usually faster than typing a password and a code, and Conditional Access can reduce prompts on trusted company devices. A short training session on what a fake login page looks like, and the rule "never approve a prompt you did not start", go a long way.
Getting help
We review and harden Microsoft 365 tenants, set up identity and access management and email security, and run cyber awareness training for teams across Los Angeles County, the Inland Empire and Ventura County. If you think an account has been compromised, call us straight away.