Problem with MFA

Question

We have problems with someone hacking into our email accounts. We set everything to MFA but he can stil login through single authentication into exchange online. How is this possible or how can we prevent him from entering with single authentication?

Answer 1

Hi @Borut Barlič
Thank you for posting your query on Q&A.
I’m sorry to hear that your user accounts have compromised even though the MFA is enabled.
The reason Threat Actor can still login through single authentication into Exchange Online is that your organization has not disabled the Basic Authentication. Basic Authentication is a legacy method that only requires a username and password which there is a chance of susceptible to attack, it doesn’t support multi-factor authentication (MFA), which is why the Threat Actor might still be able to access Exchange Online even if MFA is enabled.
To Prevent this, you can disable the Basic authentication in Exchange Online for more details you can refer the Disable Basic authentication in Exchange Online.
To protect the user accounts and password you can use below security features from Entra ID.
Password Policy
Account Lockout polices.
Microsoft Entra ID Password Protection
I hope this answer helps! please Feel free to ask any questions you may have.

Reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/block-legacy-authentication

https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online

Thanks,
Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

It would help if you used a VPN which would prevent this. Also, have you tried editing the settings and saving a few times, then signing out on all device and login in again.

Answer 3

Hello,

You can try this to solve the issue:-

1. Change the affected user password
2. Sign-out the login sessions from Admin Portal
3. On a MFA page, Select the affected user->Manage user Setting-> select "Delete all existing app passwords generated by the selected users".