So You Have MFA? Great! But... It's Not Enough.

You did the right thing. You set up Multi-Factor Authentication (MFA). 🎉 That extra step - maybe a text code, an app prompt, or an email verification - makes things safer, right? Well… kind of. But hackers have leveled up. 🤖 They’re using sneaky tricks like Adversary-in-the-Middle (AiTM) attacks and token theft to bypass MFA and waltz right into your account like they own the place.

🤯 The MFA Myth: "I have it, so I'm safe"

Reality check: Not all MFA is created equal. Many organisations still rely on older methods like SMS codes, which are easy to trick. Here’s how bad actors get around it: -

• 🔒 Phishing Attacks - They send you a fake login page, you enter your credentials and your MFA code, and they steal both. Ouch.

• 🩸 AiTM Attacks - Hackers intercept your MFA session in real-time, sneaking in while you think you’re safe.

• 🌐 Token Theft - Once they have your login token, they can skip MFA entirely and access everything, no extra codes needed.

🛡️ Enter: Phishing-Resistant MFA (AKA. The Good Stuff)

To fight back, we need Phishing-Resistant MFA methods. Microsoft 365 supports some great options: -

• ✅ FIDO2 Security Keys - These are physical devices, like a USB or NFC key, that you plug into your computer or tap on your phone. Since they require physical possession, hackers can’t steal them remotely. No passwords, no codes, just a quick tap and you’re in.

  
  

• ✅ Windows Hello for Business - Uses biometrics like your fingerprint or facial recognition to sign you in. Since your identity is tied to your physical presence and device, it’s much harder for hackers to break in - even if they steal your password.

  
  

• ✅ Certificate-Based Authentication - This method replaces traditional usernames and passwords with digital certificates stored on a secure device. Think of it as an ultra-secure, digital passport for logging in - no easily phishable codes involved.

  
  

• ✅ Passkeys - A newer technology designed to replace passwords altogether, passkeys use device-based authentication (like Face ID or fingerprint scans) that hackers can’t intercept. Since Microsoft 365 is rolling out support for passkeys, they are another great step toward true phishing resistance.

These methods stop phishing dead in its tracks. No codes to steal, no tokens to hijack.

🏠 More than MFA: Locking the front door & the windows too

MFA is one piece of the puzzle. But we also need to slam the door shut on other attack paths. That’s where Conditional Access (CA) policies come in.

• 🌍 Geo-Blocking - Why let logins from countries you don’t operate in? Block them outright.

• 💻 Require Compliant/Managed Devices - Only allow access from secure, company-approved devices.

• 👍 App Protection Policies - Make sure data on mobile devices is only accessed through approved & protected apps.

• 🛑 Block Legacy Authentication - Old login methods don’t support MFA and are easy targets. Block them ASAP.

• 🛡️ Restrict Security Registration - Limit where users can configure their authentication settings from, so hackers can’t hijack accounts.

• ➕And much more...

🚀 Go Next-Level with Microsoft Entra ID P2

Even if a hacker steals a token, Microsoft Entra ID P2 helps detect and stop suspicious logins before damage is done. It not only looks at login behaviour but also binds session tokens to specific devices, so even if stolen, they can’t be used on another device.

Imagine logging in from London in the morning… and suddenly from Brazil an hour later? 🤔 Entra ID P2 says “nope!” and blocks the access.

Important: Entra ID P2 isn’t included in Microsoft 365 Business Premium. To use it, you’ll need a Microsoft Entra ID P2 license, available as part of Microsoft 365 E5, EMS E5, or as a separate add-on per user.

💡 The Takeaway: Don't just use MFA - Use it Smartly

Hackers aren’t just after your password. They’re after your identity. And once they’re in, they can steal data, send phishing emails, or even hold your company for ransom. By upgrading to phishing-resistant MFA and enforcing secure Conditional Access policies, you make it much harder for them to succeed

🤝 Not sure where to start? We've got you.

We offer a FREE Microsoft 365 Security Audit to check your current setup and help you level up. Get in touch today and let’s lock things down before the bad guys get in!

📨 Get in touch today and let’s lock things down to keep your business secure!

• info@mondocloud.co.uk

• 0800 640 4258