TL;DR: Attackers are bypassing Microsoft 365 MFA by abusing long-lived tokens, legacy authentication, and missing token binding rather than malware, according to Abnormal AI. The real control failure is that many organisations still treat MFA as sufficient while session policy, reauthentication, and legacy protocol exposure continue to create post-login attack paths.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Microsoft 365 MFA bypasses happen through token replay, legacy auth, and session posture gaps rather than malware.
Why it matters: It matters because IAM teams cannot treat MFA as the finish line when token lifetime, reauthentication, and device-binding controls determine whether stolen access stays live.
Context
Microsoft 365 MFA bypasses are often a session and protocol problem, not a password problem. When tokens stay valid too long, legacy authentication remains enabled, or token binding is absent, an attacker can keep using access after the initial login has already been satisfied.
For IAM and NHI programmes, this shifts the control question from whether MFA exists to whether authentication state is still trustworthy after issuance. The article shows how posture gaps accumulate quietly in cloud tenants, which makes continuous configuration governance part of identity control rather than a separate hygiene task.
Key questions
Q: What breaks when Microsoft 365 MFA is treated as the final control?
A: MFA stops being effective when session tokens remain valid after the challenge, legacy protocols still accept credentials, or token replay is possible from another device. In those conditions, the attacker does not need to defeat authentication again. The control failure is assuming that a successful MFA prompt equals trustworthy access for the whole session.
Q: Why do long-lived session tokens increase Microsoft 365 account takeover risk?
A: They extend the period during which a stolen or replayed token can be used without reauthentication. That gives attackers more time to impersonate users, pivot into connected apps, and conceal activity inside normal cloud traffic. Shorter lifetimes reduce the time available for post-login abuse.
Q: How can security teams tell whether MFA bypass is coming from posture drift?
A: Look for tenants where legacy auth is still enabled, session policies are permissive, token lifetimes are long, and anomaly detection is weak or absent. Those signals show that MFA may exist on paper while the practical trust boundary has already expanded beyond it.
Q: What should IAM teams do when replayable tokens and legacy auth both exist?
A: Treat the combination as a compound identity risk rather than two separate issues. Remove legacy authentication first where possible, then harden session governance with device-bound tokens, shorter lifetimes, and post-authentication monitoring so captured credentials do not remain useful.
Technical breakdown
How long-lived tokens extend post-login exposure
Access tokens and refresh tokens are meant to reduce repeated prompts, but they also extend the useful life of a compromised session. If a tenant keeps default lifetimes or weak reauthentication settings, a token stolen through phishing or token replay can remain valid for hours or days. That means the attacker is no longer trying to defeat MFA in real time. They are operating inside an already authenticated session boundary, where conditional controls may not be rechecked often enough to matter.
Practical implication: tighten session lifetimes and reauthentication rules so token compromise does not translate into durable access.
Why legacy authentication bypasses MFA controls
Legacy protocols such as BAV2ROPC can skip modern controls like MFA and Conditional Access entirely. In practice, that creates a separate authentication path that is easier for attackers to abuse once credentials are stolen. The core problem is not just that the protocol is old. It is that the protocol preserves functionality while removing the contextual checks that modern identity policies rely on to stop account takeover.
Practical implication: inventory and disable legacy authentication paths that still accept usable credentials without modern policy enforcement.
What token binding changes in M365 session security
Token binding ties a token to a device or session context so a captured credential is harder to replay elsewhere. Without it, a valid token can be reused from a different device, location, or network, which makes stolen-session attacks much more durable. This is why post-authentication anomaly detection matters alongside issuance controls. The attacker is not defeating the login page again. They are reusing an artefact that the system still treats as legitimate.
Practical implication: require device-bound session controls and anomaly detection where stolen token replay is a realistic threat.
Threat narrative
Attacker objective: The attacker wants durable Microsoft 365 access that survives MFA and supports impersonation, lateral movement, and data theft.
- Entry occurs through phishing or credential theft, with attackers capturing valid Microsoft 365 credentials or session tokens.
- Credential abuse follows when legacy authentication or replayable tokens let those credentials work without triggering MFA challenges.
- Escalation happens as the attacker keeps access inside trusted cloud applications, then moves laterally across connected services and data stores.
- Impact is account impersonation, broader data exposure, and the persistence of access after the original authentication event should have ended.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Microsoft 365 MFA bypasses are really session-governance failures. MFA still matters, but it is no longer the whole control story when tokens stay valid after the initial challenge. The control boundary has shifted to the life of the authenticated session, which means security teams have to govern what happens after login, not just at login.
Legacy authentication creates a parallel trust path that identity programmes often understate. BAV2ROPC and similar protocols do not merely weaken MFA. They create an alternative authentication route that can accept stolen credentials while sidestepping the policy stack modern tenants expect to enforce. The practical implication is that protocol inventory is part of identity assurance, not a side task.
Token binding is the missing control that turns stolen sessions into usable sessions. When a token can be replayed from another device, the attacker inherits trust that the platform has not revalidated. That is why the real governance issue is not token issuance alone, but whether the platform can still distinguish the original device and context from the attacker’s replay environment.
Posture drift in Microsoft 365 is an identity control problem, not a configuration footnote. Default token lifetimes, missing reauthentication, and weak anomaly detection accumulate quietly because they do not look like incidents until after compromise. Continuous posture review is therefore a governance requirement for cloud identity, especially where authentication artifacts outlive the conditions that created them.
Identity programmes need a named concept for this pattern: session persistence debt. It is the accumulated risk created when authentication artefacts remain trusted longer than the environment that issued them can safely assume. In Microsoft 365, that debt shows up in long-lived tokens, replayable sessions, and legacy login paths, so practitioners should treat session governance as a first-class identity control domain.
From our research library:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
What this signals
Session persistence debt: Microsoft 365 environments accumulate risk when tokens and login state remain trusted longer than the platform can safely assume the device, location, or user context is unchanged. That turns identity governance into a continuous session validation problem rather than a one-time MFA deployment.
The practical question for IAM and security teams is no longer whether MFA is enabled, but whether the surrounding controls invalidate stolen access quickly enough to matter. Legacy authentication removal, token binding, and anomaly detection should be governed together because each one closes a different part of the same post-login abuse path.
For practitioners
- Tighten token lifetimes Review Microsoft 365 token and session lifetimes, then shorten defaults where business workflows do not require prolonged persistence. Pair the change with reauthentication settings so a stolen token has a smaller usable window.
- Disable legacy authentication paths Identify protocols such as BAV2ROPC and remove them from tenants that still allow modern authentication. Treat any remaining legacy sign-in path as a standing account-takeover route, not a compatibility detail.
- Bind tokens to device context Enable token binding or equivalent device-bound session controls where the environment supports them. This reduces the value of a captured token because replay from a new device should fail or trigger investigation.
- Add post-authentication anomaly checks Monitor impossible travel, unfamiliar device use, and unusual post-login activity to catch replayed sessions that have already satisfied MFA. Feed those signals into incident triage before lateral movement spreads.
Key takeaways
- Microsoft 365 MFA bypasses are driven by session and protocol weaknesses that let attackers keep using access after the initial challenge.
- Long-lived tokens and legacy authentication create the exposure window, while token binding and reauthentication determine whether stolen access remains usable.
- The control that matters most is not MFA alone, but whether the tenant can detect, constrain, and invalidate post-login abuse before lateral movement begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on authentication paths that still succeed despite MFA. |
| NHI-07 — Long-Lived Secrets | Long-lived tokens extend the usable window for compromised sessions. | |
| NHI-10 — Human Use of NHI | Captured tokens behave like reusable identity artefacts that outlive the original user action. | |
| Recommendation — Remove authentication paths that let stolen credentials or tokens bypass modern policy checks. Shorten token and session lifetimes so captured access expires before it can be abused. Treat session tokens as sensitive identity artefacts and govern their replay risk explicitly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is whether access remains valid after authentication and policy changes. |
| Recommendation — Review entitlements and session authorizations continuously so stale access does not persist. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article describes token capture followed by movement inside connected cloud apps. |
| Recommendation — Map token replay and post-login abuse to credential access and lateral movement detections. | ||
Key terms
- Token Binding: Token binding links a token to a specific device, certificate, or connection so it cannot be reused elsewhere without the bound proof. It reduces replay risk by making theft alone insufficient, although it does not remove the need for monitoring and revocation.
- Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
- Session persistence debt: Session persistence debt is the residual risk created when active sessions continue after the event that should have ended them. It accumulates when revocation is delayed, partial, or only applied on the client side, leaving access live longer than the organisation intends.
- Post-Authentication Anomaly Detection: Post-authentication anomaly detection looks for suspicious activity after a login has already succeeded, such as impossible travel, unfamiliar devices, or unusual app access. It is essential when attackers can satisfy MFA and still keep operating through a valid session.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org