MFA Isn't Enough: What Actually Stops Account Takeover

Multi-factor authentication is still one of the most important security controls a business can put in place. But “we have MFA” is not the same as “our accounts cannot be taken over”. The useful question is what kind of MFA you use, what happens after the sign-in, and what other controls decide whether that sign-in should be trusted in the first place.

That distinction matters because account takeover has moved beyond simply guessing passwords. Attackers can pressure people into approving unexpected prompts, proxy a legitimate Microsoft sign-in through a convincing phishing page, or steal an authenticated session after the user has already completed MFA.

MFA can work exactly as designed and an account can still be compromised

In one healthcare incident we were already involved with, MFA was enabled. One Microsoft 365 account was compromised, and an email sent from that account led to a second account being compromised. We do not have evidence that establishes how the first account was compromised, so we are not going to invent an explanation for it.

The point is simpler: MFA materially reduces risk, but it does not close every path to an account.

One well-documented example is adversary-in-the-middle phishing. Microsoft describes this as a phishing site acting as a proxy between the user and the genuine service. The user enters their credentials and completes the MFA challenge against what appears to be the real sign-in. The attacker can capture both the credentials and the authenticated session cookie and then use that session on the legitimate service. Microsoft documents this mechanism in its guidance on session cookie theft and adversary-in-the-middle attacks.

That is why the right security question is no longer just “is MFA turned on?” It is “how resistant is our sign-in process to phishing, and what else has to be true before access is granted?”

Not all MFA methods provide the same protection

SMS codes, app-generated codes and approval prompts are all better than relying on a password alone. They are also still methods a person can be tricked into handing over or approving.

Phishing-resistant authentication changes that. Methods based on FIDO2, including suitable passkeys and physical security keys, bind the authentication to the legitimate service. A fake Microsoft sign-in page cannot simply ask the user for a code and replay it somewhere else.

Microsoft Entra treats phishing-resistant MFA as its strongest built-in authentication strength and specifically recommends it for privileged administrator roles. Microsoft documents passkeys, FIDO2 security keys and other supported methods as part of that phishing-resistant authentication model. See Microsoft’s current guidance on requiring phishing-resistant MFA and deploying passkeys in Microsoft Entra ID.

For a small professional-services business, that does not necessarily mean replacing every authentication method overnight. A sensible progression is to make MFA universal, remove weak legacy methods where practical, and move higher-risk users and sensitive systems toward phishing-resistant authentication first.

Conditional Access decides when a sign-in should be trusted

Authentication is only one part of the decision. Microsoft Entra Conditional Access can apply rules based on the user, the resource they are accessing, the authentication strength they used, the device and other sign-in conditions.

That lets you move from a blanket rule such as “everyone must use MFA” to policies such as “administrators must use phishing-resistant MFA” or “this application can only be accessed from a compliant managed device”. Microsoft’s authentication-strength controls are designed to work inside Conditional Access so the required sign-in method can change with the sensitivity of the resource.

This is also where implementation quality matters. Conditional Access policies can lock people out if they are switched on carelessly. Microsoft recommends staged deployment, including report-only testing and appropriate emergency-access exclusions. It is not a control to copy from a checklist and hope for the best.

What a reasonable Microsoft 365 identity setup looks like

For the kinds of businesses ITstuffed supports, a sensible identity baseline usually means:

• MFA is required for users rather than left optional.
• Privileged administrator accounts receive stronger protection than ordinary day-to-day accounts.
• Phishing-resistant authentication is used where the risk justifies it and is progressively rolled out more broadly.
• Conditional Access policies decide which users, devices and authentication strengths are acceptable for sensitive access.
• Devices are managed and protected, because a compromised endpoint can undermine an otherwise strong sign-in process.
• Sign-in activity is monitored so unusual access is investigated rather than discovered weeks later.
• Staff know that an unexpected MFA prompt is a security event, not an annoyance to approve until it disappears.

None of those controls replaces the others. Passkeys do not remove the need for Conditional Access. Conditional Access does not make an unmanaged infected laptop safe. MFA does not replace monitoring. The strength comes from the controls working together.

Where passwords and password spraying fit

Password hygiene still matters because many business systems have not moved completely away from passwords, and an exposed password is often the first ingredient in an account-takeover attempt. That is a slightly different problem from choosing the right MFA method, so we have kept our guides on password spraying and password management as separate related topics rather than trying to make this article cover every credential risk.

Likewise, once an attacker controls a real mailbox, the problem can spread to colleagues, suppliers and clients. Our business email compromise explainer covers that next stage.

How to tell whether your current setup is actually strong

If the answer to “do we have MFA?” is yes, the next questions are more useful:

• Which MFA methods are still allowed?
• Are administrator accounts protected more strongly?
• Do we use phishing-resistant authentication anywhere?
• What Conditional Access policies are actually enforced?
• Can unmanaged devices still reach sensitive Microsoft 365 data?
• Who is reviewing suspicious sign-ins and identity alerts?

If you cannot answer those questions, you do not necessarily have a security problem. You have an assurance problem: you know a control exists, but not whether the whole identity setup works as intended.

Our free IT Security Self-Check gives you a quick view of the wider security baseline. If identity and Microsoft 365 access need a deeper review, see how we approach managed cyber security or book a 15-minute IT Fit Check.