Microsoft Entra, identity that holds when attackers try the front door.

This is now the most common identity incident we respond to in the UAE, and it surprises people because they did the thing they were told to do. Multi-factor authentication is necessary and it is no longer sufficient on its own. Understanding why changes what you deploy.

• Adversary-in-the-middle phishing defeats ordinary MFA. The victim receives a convincing link, signs in on a proxy that relays every step to the real Microsoft login, approves the push notification themselves because they genuinely are signing in, and the attacker captures the resulting session token. No code was guessed and no password was cracked. The stolen token is then replayed and the attacker is inside with a valid session.
• The defences that actually work against it are phishing-resistant methods, FIDO2 security keys or Windows Hello for Business, which are bound to the real domain and simply will not authenticate against a proxy. Conditional access requiring a compliant or hybrid-joined device is the next best control, because a stolen token from an unmanaged machine then fails the device check.
• The second most common route is not phishing at all, it is legacy authentication. Protocols that predate modern authentication cannot present an MFA challenge, so an attacker who finds one enabled simply uses a valid username and password and is never asked for a second factor. Blocking legacy authentication is a single policy and it closes the entire category.
• The third is the standing exclusion group. Almost every tenant has one, created for a service account or an executive who found MFA inconvenient, and it grows quietly. Attackers do not need to defeat your MFA if there is a documented list of accounts exempt from it. Review that group today, and if it has more than break-glass accounts in it, that is where to start.