Microsoft 365 Exchange: MFA enrollment notification email deletion

Attackers who successfully compromise an account often register an unauthorized MFA device as a means of maintaining persistence. To prevent the legitimate user from noticing the security change and receiving the corresponding MFA enrollment or registration notification, adversaries frequently delete or move these emails to the deleted items folder. This behavior is a common indicator of business email compromise (BEC) and account takeover operations.

Attack Chain

1. Initial access to user account gained via compromised credentials.
2. Actor navigates to account security settings or MFA registration portal.
3. Actor registers a new, attacker-controlled MFA device (e.g., authenticator app or phone number).
4. Microsoft 365 generates a security notification or enrollment confirmation email.
5. Actor identifies the specific notification email in the user's inbox.
6. Actor performs a soft delete, hard delete, or moves the email to the Deleted Items folder to hide evidence of the MFA change.

Impact

Successful exploitation allows an adversary to maintain persistent access to a compromised account even if the legitimate user changes their password, as the attacker-controlled MFA device remains active.

Recommendation

• Deploy detection logic to monitor Microsoft 365 audit logs for the deletion of emails with subject lines containing MFA-related keywords.
• Investigate any user account flagged for MFA notification deletion by reviewing Azure AD sign-in logs and MFA registration history.
• Implement conditional access policies to restrict MFA registration activity to trusted locations or managed devices to limit the impact of compromised credentials.
• Review inbox rules for unauthorized automated forwarding or deletion configurations that may be used to suppress security alerts.