Why multi-factor authentication is not enough on its own

Multi-factor authentication (MFA) is the single most effective measure against leaked passwords. Even so, it is too early to say “MFA is on, we are safe”. Attackers have started to target not the password but the session that exists after authentication is complete. In this article we explain the conditional access policies that complement MFA.

Three ways around MFA

• Session theft: a fake sign-in page relays the user to the real site; the user completes MFA and the attacker takes the session token.
• Approval fatigue: a user worn down by a stream of approval prompts finally presses “Approve”.
• Legacy protocols: when old mail protocols that do not support MFA are left enabled, the password alone is enough.

We close the gaps with conditional access

• We allow access only from managed, compliant devices; a stolen session does not work on another device.
• Instead of tapping a prompt, we require the number shown on screen to be entered, and move administrators to phishing-resistant methods.
• We disable legacy authentication protocols entirely.
• On signals such as an unusual country, impossible travel or a risky session, we block access or ask for authentication again.
• We shorten session lifetimes and separate administrator accounts from day-to-day use.

Most of these settings come with the Microsoft 365 Business Premium licence; the task is not to buy another product but to configure what you already have properly. See our Microsoft 365 and Cloud page for details.