What to Do When Multi-Factor Authentication Is Enabled but Accounts Still Get Compromised

Multi-factor authentication reduces the risk of password-only access, but an account can still be compromised through stolen sessions, unsafe recovery processes, phishing approvals, legacy authentication, or an unmanaged device. If an account is suspected, changing the password alone may not end active access.

Contain current access

Use a clean administrator device and follow the identity provider's incident process. Revoke active sessions and tokens where supported, review sign-in history, and check forwarding rules or delegated access in affected services. Preserve logs and coordinate credential resets with the incident owner.

Review the path that bypassed protection

• Check whether legacy protocols or app passwords can bypass the normal MFA flow.
• Inspect recovery phone numbers, backup codes, trusted devices, and authentication method changes.
• Look for session cookie theft, suspicious OAuth grants, and new application consent.
• Confirm endpoint health and browser extensions on the user's device.
• Review privileged accounts separately and require stronger controls for administration.

Strengthen the workflow

Use phishing-resistant authentication where appropriate, limit standing admin access, and make sign-in alerts actionable. Test recovery procedures so users can regain access without creating an easier route for attackers.

Informatix Systems lists identity and endpoint security related services. A review can map sign-in controls, device posture, recovery, and privileged access for the environment. Contact Informatix Systems if MFA has not prevented account risk.