Notifications
Clear all
Topic starter
27/06/2026 1:58 pm
TL;DR: Attackers are bypassing Microsoft 365 MFA by abusing long-lived tokens, legacy authentication, and missing token binding rather than malware, according to Abnormal AI. The real control failure is that many organisations still treat MFA as sufficient while session policy, reauthentication, and legacy protocol exposure continue to create post-login attack paths.
NHIMG editorial — based on content published by Abnormal AI: Microsoft 365 MFA bypasses through long-lived tokens, legacy auth, and posture gaps
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams reduce Microsoft 365 MFA bypass risk?
A: They should focus on the controls that make MFA meaningful after login: disable legacy authentication, shorten token lifetimes, and bind sessions to device context.
Q: Why do long-lived tokens create more risk than a failed password attack?
A: A failed password attack ends at the login screen, but a stolen token can preserve access after MFA and keep working until it expires or is revoked.
Q: What do teams get wrong about Conditional Access and legacy protocols?
A: They often assume Conditional Access covers all sign-ins equally, but legacy protocols can bypass the modern policy layer entirely.
Practitioner guidance
- Audit all enabled authentication protocols Identify every Microsoft 365 sign-in path that still accepts legacy authentication, then remove exceptions that bypass Conditional Access and MFA.
- Shorten token lifetimes and reauthentication windows Review default session settings for high-risk user groups and reduce the period in which a stolen token remains valid.
- Bind sessions to device context Use device binding or equivalent controls so a token captured on one endpoint cannot be replayed freely elsewhere.
What's in the full article
Abnormal AI's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how Gamma App, BAV2ROPC, and Docusign-hosted phishing campaigns bypass MFA in Microsoft 365.
- Guided remediation steps for Continuous Access Evaluation, legacy authentication removal, and token binding.
- Posture management workflow detail showing how misconfigurations are discovered, prioritised, and remediated over time.
- Operational context on how Microsoft 365 settings drift silently and how to verify control coverage across tenants.
👉 Read Abnormal AI's analysis of Microsoft 365 MFA bypass through tokens and legacy auth →
M365 MFA bypasses: are your token and auth controls keeping up?
Explore further
27/06/2026 3:31 pm
Microsoft 365 MFA is only as strong as the session policies around it. The control failure here is not that MFA was absent, but that post-authentication access remained usable for too long through long-lived tokens and weak reauthentication. In governance terms, the real boundary is the session, not the login screen. Practitioners should treat MFA effectiveness as a lifecycle issue for access tokens, not a one-time authentication event.
Post-MFA access is now the control surface that matters. Teams that still treat MFA as the endpoint of authentication will miss the session, protocol, and token problems that attackers actually exploit. The practical shift is to govern identity proof after issuance, not just at the sign-in moment, and to review legacy authentication with the same scrutiny as privileged access paths.
A question worth separating out:
Q: Who is accountable when a valid session token is replayed?
A: Accountability usually spans IAM, endpoint, and cloud platform owners because replay indicates a control gap across session governance, device context, and authentication policy. The key question is whether the organisation had explicit controls for token binding, reauthentication, and legacy-auth removal. If not, the failure is architectural, not just operational.
👉 Read our full editorial: M365 MFA bypasses stem from tokens, legacy auth, and posture gaps
