Quick Answer: Yes. Multi-factor authentication (MFA) stops most password-only attacks, but business email can still be compromised in four common ways: fake login pages that steal your session after you approve MFA, repeated MFA prompts until someone taps Approve, tricking a user into granting an app access, and taking over the phone number that receives text codes. MFA is necessary. It just isn't sufficient on its own.
BridgeNet's cybersecurity team helps businesses close the gaps MFA leaves open.
Why isn't MFA enough on its own?
MFA does one job very well. It makes a stolen password useless by itself.
That's why every Microsoft 365 account should have it.
But attackers adapted. Instead of trying to beat MFA, many now wait for the user to complete it, then take what comes after: the signed-in session.
When you sign in to Microsoft 365 and approve MFA, your browser gets a session token. Think of it as a wristband at an event. Once you have it, nobody checks your ID again for a while.
If an attacker gets the wristband, they don't need your password or your phone.
How do attackers get around MFA?
1. Fake login pages that pass MFA through
The user gets a convincing email, often a shared document or a voicemail notice. The link opens a page that looks exactly like the Microsoft sign-in.
Behind the scenes, that page passes everything to the real Microsoft sign-in in real time. The user enters their password, approves the MFA prompt, and gets signed in normally.
The attacker's page captures the session token on the way through. Now they're signed in too, with MFA already satisfied.
Security teams call this an adversary-in-the-middle attack. Ready-made kits that automate it are sold online, so it is no longer limited to large targets. Small businesses see it too.
2. MFA fatigue
The attacker already has the password. They trigger sign-in prompt after prompt, often late at night, until the user taps Approve to make it stop.
Microsoft Authenticator now asks users to type a number shown on the sign-in screen, which makes this much harder. Simple yes/no approvals and text codes are still easier targets.
3. App consent tricks
The user is shown a real Microsoft permission screen asking them to let an app "read your mail." Clicking Accept gives the app ongoing access to the mailbox.
No password is stolen and no MFA prompt is involved, because the user granted the access.
4. Phone number takeover
If MFA codes arrive by text message, an attacker who convinces a mobile carrier to move the user's number to a new SIM card receives those codes instead.
This is one reason text-message codes are the weakest form of MFA. If your team still uses them, moving to the Microsoft Authenticator app is a quick, low-cost upgrade.
Does this mean MFA isn't worth it?
No. MFA is still one of the most effective steps a business can take.
Without it, a single reused password can hand over a mailbox. With it, attackers have to work harder, use more targeted methods, and leave more traces.
The right way to think about it: MFA is the lock on the front door. You still want an alarm system, and someone watching it.
What closes the gaps MFA leaves open?
The fixes are layers on top of MFA, not replacements for it.
- Phishing-resistant sign-in methods. Passkeys, hardware security keys, and Windows Hello for Business are tied to the real Microsoft site, so a fake login page can't use them.
- Conditional Access. Rules that only allow sign-ins from company-managed devices or expected locations. A stolen session from an unknown laptop overseas gets blocked.
- Number matching in Microsoft Authenticator instead of simple Approve buttons or text codes.
- Admin approval for new apps, so users can't grant mailbox access to an unknown app on their own.
- Sign-in risk alerts, reviewed by someone who knows what normal looks like for your business.
- Training that matches today's attacks. Users should know that a real-looking Microsoft login page can still be fake, and that an unexpected MFA prompt means someone has their password.
How can you tell if your setup has these gaps?
Ask your IT provider these questions:
- Which MFA method are our users on: text codes, Authenticator, or passkeys?
- Can someone sign in to our Microsoft 365 from any device, anywhere?
- Can employees approve apps that read their mailbox without admin review?
- Who reviews risky sign-in alerts, and how quickly?
- Are external forwarding and inbox rule changes monitored?
If the answers are "we're not sure," that's useful information. It means the gaps haven't been checked yet.
Want straight answers to those five questions for your business? BridgeNet's team will review your Microsoft 365 sign-in and email security settings and tell you plainly what's covered and what isn't. Call 985-635-4380 or schedule a free cybersecurity assessment.
