MFA is essential. But attackers have adapted. Adversary-in-the-middle phishing, MFA fatigue attacks, and token theft can bypass MFA entirely. Here's what the full Business Premium security stack does about it.
Key takeaways
- 1Adversary-in-the-middle (AiTM) phishing — sophisticated phishing kits proxy the real Microsoft login page, capturing both the password and the session token after MFA is completed.
- 2MFA fatigue (push bombing) — attackers flood a user with MFA push notifications until, in frustration, the user approves one. Microsoft's Number Matching feature helps, but isn't u
- 3Legacy authentication protocols — older email protocols like IMAP and SMTP bypass modern authentication entirely, meaning MFA never triggers.
Multi-factor authentication is the single most impactful security control for most businesses. Microsoft's own data confirms it blocks more than 99.9% of account compromise attempts. But that number is from several years ago — and attackers have adapted.
How attackers bypass MFA
- Adversary-in-the-middle (AiTM) phishing — sophisticated phishing kits proxy the real Microsoft login page, capturing both the password and the session token after MFA is completed. The attacker replays the token, bypassing MFA entirely.
- MFA fatigue (push bombing) — attackers flood a user with MFA push notifications until, in frustration, the user approves one. Microsoft's Number Matching feature helps, but isn't universally deployed.
- Legacy authentication protocols — older email protocols like IMAP and SMTP bypass modern authentication entirely, meaning MFA never triggers.
What Business Premium adds beyond basic MFA
- Phishing-resistant MFA via Windows Hello for Business — certificate-based authentication that can't be intercepted by AiTM attacks
- Conditional Access blocking legacy authentication — eliminates the MFA bypass vector entirely
- Entra ID Identity Protection — detects token replay and impossible travel as high-risk sign-ins, triggering automatic remediation
- Defender for Office 365 anti-phishing — detects and blocks AiTM phishing sites before users can interact with them
- Number Matching for MFA push notifications — blocks MFA fatigue attacks
What an MSP needs to configure
None of these controls are on by default. Legacy authentication blocking must be explicitly configured in Conditional Access. Identity Protection risk policies must be created. Number Matching must be enforced in the Authentication Methods policy. Optimyze deploys all of these on every new engagement — and reviews them quarterly as Microsoft's threat intelligence evolves.
