MFA Fatigue, Helpdesk Reset, and a Shared Vendor Account
A 3,000-employee SaaS company has 400 service accounts. At 23:40 a finance user reports 14 MFA push notifications. The helpdesk resets the password after a spoofed caller ID. Next morning, a vendor support account with Global Reader and mailbox delegation to the CFO signs in from a new ASN. Conditional access requires MFA, but the vendor account is excluded from the location policy. Sign-in logs show legacy IMAP authentication from a /24 in another country. The vendor says three engineers share the account credentials. The CFO’s assistant reports a new inbox rule forwarding invoices to an external address. The vendor account has no named owner. You must contain the incident, assess the shared vendor account, and scope the compromise without triggering a company-wide password reset.
1. What immediate containment actions would you take, and in what order? Justify the sequence.
Read the worked answer
Contain in an order that stops access without destroying evidence.
- Revoke all sessions and refresh tokens for the finance user, the vendor account, and the CFO. Disabling an account alone may not invalidate stolen tokens.
- Reset the finance user’s password and re-register MFA after verifying identity through a separate channel. Check for new MFA methods, app passwords, and mailbox rules.
- Disable the shared vendor account and reset its credentials; remove mailbox delegation and Global Reader pending review. Preserve sign-in and audit logs before making changes where possible.
- Inspect the CFO’s mailbox for forwarding rules, inbox rules, delegated access, and recent searches; remove malicious rules and preserve a copy as evidence.
- Block legacy IMAP authentication for the tenant or, if that is not immediately possible, block the source /24 and require modern authentication.
- Notify the CFO and legal/privacy according to policy; the invoice-forwarding rule suggests possible data exfiltration.
Do not do a company-wide password reset yet. Scope first. Overreacting disrupts 3,000 users and can destroy evidence; underreacting leaves the vendor path open.
2. Assess the shared vendor account and propose a target access model. What should change before vendor access is restored?
Read the worked answer
The shared vendor account is a governance and detection failure. Three engineers sharing credentials means no attribution, no individual accountability, and no way to revoke one person without disrupting others. Global Reader plus mailbox delegation to the CFO gives excessive read access, and exclusion from the location policy creates a policy gap.
Target model:
- Named accounts for each vendor engineer, federated to the vendor’s identity provider if possible, with individual MFA.
- Just-in-time privileged access through PIM or similar, time-bound and approved, instead of standing Global Reader.
- Separate admin accounts from mailbox access; remove CFO delegation unless a documented business need exists and is time-bound.
- Conditional access applied to vendor accounts, including location and device posture, with no blanket exclusion.
- Contractual requirements for vendor MFA, logging, and immediate notification of personnel changes.
- Quarterly access review with the vendor and automatic disablement at contract end.
Migration can be phased, but the shared account should remain disabled until named accounts are in place and tested.
3. How would you scope the compromise without overreacting, and when would a company-wide password reset be justified?
Read the worked answer
Scope using identity and mailbox evidence before resetting everyone.
- Build a timeline from the first MFA push at 23:40 through the vendor sign-in. Correlate helpdesk ticket, caller ID, password reset, and MFA registration events.
- Review sign-in logs for the finance user, vendor account, and CFO: source IPs, ASNs, device IDs, authentication protocol, and success/failure. Legacy IMAP success is a strong indicator of token or password misuse.
- Audit mailbox rules, forwarding, delegation, and file access for the CFO and finance user. Check for data staging or download volume.
- Check whether the vendor account accessed other mailboxes or SharePoint/OneDrive, and whether Global Reader was used for enumeration.
- Look for lateral attempts: password spray, MFA fatigue against other users, helpdesk resets in the same window, and new service accounts.
A company-wide reset is justified only if you find evidence of broad credential compromise, such as a successful password spray across many accounts or a compromised identity provider. Otherwise, targeted containment plus a tenant-wide legacy-auth block and MFA number matching is proportionate. Document the scoping decision and rationale.