Microsoft recently helped dismantle a phishing operation that had compromised more than 12,000 inboxes across over 10,000 organizations worldwide. Its entire purpose was getting past multifactor authentication.
That's the shift most practice owners haven't caught up to yet.
MFA was built to stop someone who steals your password. It works — which is exactly why attackers stopped going after passwords and started going after what MFA hands you afterward: the session.
Think of a wristband at a concert. They check your ID once at the door, band you, and nobody checks again all night. Steal the wristband and you walk right in.
In a medical office it looks like this. Someone at the front desk gets an email that looks like a shared file. They sign in. They approve the prompt on their phone, because it really was them signing in. The attacker rides that same session into the mailbox and quietly adds a rule so the real replies never land in the inbox.
Resetting the password doesn't close it. Microsoft says so directly — you have to revoke the session and remove what the attacker left behind.
The fix isn't exotic. Phishing-resistant sign-in like passkeys or a security key, legacy authentication switched off, and access limited to devices you actually manage. Most practices already pay for all three and run none of them.
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email