Multi-factor authentication stops the vast majority of attempts to break into a Microsoft 365 account. If it isn’t yet on for your whole team, that’s the first thing to do. It does have limits, though, and today’s attacks aim squarely at them.
How a code gets bypassed
The most common method is the fake sign-in page. An email links to a page that looks exactly like Microsoft’s. The person types their password, then the code from their phone. The page passes both to the real site, live, and captures the session that opens. The intruder is signed in, and won’t need a code again for as long as that session lasts.
There’s a cruder variant: an attacker who already has the password triggers approval request after approval request, often late in the evening, until someone taps “Approve” out of weariness or by accident. Number matching, now standard, has made this harder without making it disappear.
Either way, multi-factor authentication did its job. It was the person who was fooled.
Checking where a sign-in comes from
The most effective answer is to stop treating the right code as enough. Access rules check the context of every sign-in: is it from a company laptop, a protected app, a country where your team works? A session opened through a fake page, from a stranger’s machine, doesn’t meet those conditions and is blocked, even with the password and the code.
These rules come with Microsoft 365 Business Premium. They need careful tuning so they don’t lock out a colleague on the move or an administrator who has to step in. That’s one of the reasons we recommend Premium, as we explain in Business Standard or Business Premium: which should a small business choose?
Sign-ins a fake page can’t imitate
Passkeys, fingerprint or face sign-in on a company laptop, and physical security keys all work on a different principle: they only work on Microsoft’s real site. A fake page has nothing to relay. For administrator accounts in particular, these methods should be the norm.
Fewer traps in the inbox
Advanced email filtering checks links at the moment they’re clicked, so a malicious page detected after the message was sent is still blocked. It doesn’t replace access rules, but it cuts the number of times someone has to make the right call.
And if a sign-in gets through anyway
No protection is perfect. An unusual sign-in (an unexpected country, an unknown device, a forwarding rule created in the middle of the night) needs spotting and dealing with quickly: account blocked, sessions closed, cause understood. With the Cloud offer, account protection is in place from the start. For more exposed organisations, 24/7 monitoring adds someone watching and responding at any hour; we discuss it case by case, depending on your situation.
