Skip to content

Home
About Me

MFA is not enough

Token Theft in M365: Why MFA Fails and How to Fix It

April 21, 2026 by deniscooper@me.com

MFA is Not Enough: How to protect tokens in Microsoft Entra ID

MFA doesn’t stop token theft. Learn how to protect access tokens in Microsoft Entra ID using passkeys, token protection, and Conditional Access.

Categories AZURE, ENTRA, SECURITY Tags Entra ID Security, MFA is not enough, MiTM Proxy Attack, Passkeys, Token theft 1 Comment

Search

Recent Posts

Terraform Module Lifecycle: From First Variable to a Release Teams Can Trust
Terraform Module Testing as Governance: The Part That Actually Enforces the Rules
Terraform Calling Conventions: How Your Modules Should Actually Talk to Each Other
Terraform Module Boundaries: What Actually Belongs in a Module
Terraform Repo Structure: Module Repos & Golden Paths Explained

Recent Comments

Kevin on GitHub Actions OIDC Authentication to Azure
Kevin on Token Theft in M365: Why MFA Fails and How to Fix It
Andrea R. on Entra vs Azure RBAC: Why Global Admin Doesn’t Mean What You Think
David Gómez on Entra Workload Identities Explained: Service Principals vs Managed vs Federated
Andrea R. on Shift Cost Left: Adding Infracost to Your IaC Pipelines

© 2026 deniscooper.co.uk • Built with GeneratePress