Conditional Access evaluates a sign-in once, then stops evaluating it. A 2025 phishing campaign confirmed a 50%+ success rate against Microsoft 365 accounts that already had MFA enabled, by capturing session tokens right after MFA succeeded. Part 3 of The Security Bridge series covers the fix: authentication strength, Token Protection, and what to validate this week. For security architects, engineers, and CISOs who assume MFA enrollment closes the risk on its own.