Based on Lab: EID-EXP-015 (f11.ca)
Most organizations have made significant progress in improving security.
They have implemented Multi-Factor Authentication (MFA).
This is a positive step.
However, a critical issue remains: MFA only protects the login—not what happens after. To understand this risk, let's examine what happens next.
In our latest lab, we tested how access behaves in Microsoft Entra ID after MFA is approved. This leads us to uncover a hidden risk that many businesses are not actively managing.
What We Observed
A user:
- Logs into Microsoft 365
- Enters password
- Approves MFA
At this stage, the environment appears.
However, in the background: A session is created
That session remains active
Subsequently:
- The user walks away
- Returns later
- Opens email or files
As a result:
- No password required
- No MFA prompt
- Full access remains available
Why This Is Important for Your Business
This behavior is intentional and designed for usability.
But from a business perspective, this creates an unmonitored window during which unauthorized access or misuse of data can occur, increasing the risk of data breaches and operational disruption.(Response, 2023)
Practical Implications
1. Unattended Devices Result in Open Access
Employees step away from their laptops.
If sessions are still active:
- Anyone with physical access to the device can access company data.
2. Compromised Devices Can Lead to Undetected Breaches
If malware or unauthorized access occurs:
- Attackers do not require credentials.
- They can exploit the active session.
3. Email and Data Exposure
With an active session, attackers can:
- Read emails
- Access files
- Download sensitive data
This occurs without additional authentication prompts.
4. Financial and Operational Risks Risk
This can lead to:
- Invoice fraud
- Data leaks
- Business disruption
- Compliance issues
Why Most Organizations Overlook This Risk
Many businesses assume:
- “We have MFA, so we are secure.”
But in reality:
- MFA is a one-time checkpoint.
- Sessions remain trusted afterward.
- Session controls are seldom reviewed. (2023 NSA Cybersecurity Year in Review, n.d.)
The Actual Risk Gap
Strong authentication does not provide continuous protection. (Weinert, 2023)
The gap exists between:
- Login security
- Ongoing access control
Key Areas to Review
Every organization should validate the following areas:
1. Session Duration
- How long do users stay logged in?
- Is re-authentication required?
2. Session Revocation
- Can access be terminated quickly if needed?
3. Device Trust
- Are only managed/compliant devices allowed?
4. Access Policies
- Are Conditional Access policies covering all scenarios?
Key Business Takeaway
If a session remains active, someone can access company resources without additional MFA, potentially leading to unauthorized data access, theft, or misuse before anyone notices. (Microsoft Incident Response lessons on preventing cloud identity compromise, 2023)
This is the underlying risk.
Our Recommendations
Organizations should take the following actions:
- Review session and access policies
- Reduce long-lived sessions
- Align security controls with actual user behavior.
How to Begin
If you are unsure whether this risk exists in your environment:
Start by reviewing how long users remain logged in after MFA.
Identify whether sessions are actively managed.
Need help validating this in your tenant?
Schedule your free consultation with AITS.ca today.
Identity Security Assessment
About This Lab
This insight is based on:
EID-EXP-015 – Session Persistence & MFA Bypass Risk (f11.ca)
We test real-world identity security scenarios to help organizations identify actual risks, not just assumed ones.
Final Thought
MFA is essential.
However, on its own, it does not provide complete protection.
The key question is what occurs after the user logs in.
References
Response, M. I. (December 4, 2023). Microsoft Incident Response lessons on preventing cloud identity compromise. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2023/12/05/microsoft-incident-response-lessons-on-preventing-cloud-identity-compromise/
(n.d.). 2023 NSA Cybersecurity Year in Review. https://media.defense.gov/2023/Dec/19/2003362479/-1/-1/0/NSA_Cybersecurity_YiR23_Book_508.PDF
Weinert, A. (November 5, 2023). Automatic Conditional Access policies in Microsoft Entra streamline identity protection. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2023/11/06/automatic-conditional-access-policies-in-microsoft-entra-streamline-identity-protection/
(December 4, 2023). Microsoft Incident Response lessons on preventing cloud identity compromise. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2023/12/05/microsoft-incident-response-lessons-on-preventing-cloud-identity-compromise/