Token theft and session hijacking: what to harden in Entra ID

EntraGUARD·2026-07-30·8 min

MFA stopped the password from being enough, so attackers moved past it. Token theft steals the session after authentication, sidestepping MFA entirely. Understanding it changes what you harden.

MFA stopped the password from being enough — so attackers moved past the password. Token theft steals the proof of a session after authentication, sidestepping MFA entirely, and it is now one of the most common ways into a hardened Entra ID tenant. Understanding it changes what you harden.

Why stealing the token beats stealing the password

When a user signs in and passes MFA, Entra ID issues tokens that represent the authenticated session. Those tokens live in the browser and on the device. If an attacker can lift a token — through malware, a malicious browser extension, or an adversary-in-the-middle phishing page that proxies the real sign-in — they can replay it and act as the user without ever facing an MFA prompt, because the MFA already happened. The password and the second factor become irrelevant.

What actually reduces the exposure

Phishing-resistant MFA — FIDO2 keys and certificate-based authentication defeat the adversary-in-the-middle proxy that harvests replayable tokens.
Token protection / conditional access session controls — binding tokens to the device so a lifted token is useless elsewhere.
Device compliance — requiring a managed, compliant device raises the bar for where a token can be replayed from.
Shorter sign-in frequency for high-value access, so a stolen token expires sooner.
Risk-based policies — impossible-travel and anomalous-token signals that revoke sessions automatically.

MFA on its own is no longer the finish line. A tenant can have MFA everywhere and still fall to token theft. The audit question has shifted from "is MFA enforced" to "is the MFA phishing-resistant, and are sessions bound and short". Reporting only on MFA coverage now understates the risk.

Audit for the whole path

Token theft is not a single setting; it is a chain — a phishable method, a long-lived unbound session, an unmanaged device. An audit that checks each link, and a simulation that reasons about whether the chain is exploitable end to end, catch what a single-control check misses. EntraGUARD scores token theft and session hijacking as an explicit path in the attack simulator, alongside the Conditional Access and authentication-method controls that close it.