I sat down with an IT provider today who stated they don’t use SSO because its insecure.<\/p>\n\n\n\n
They said its insecure because if the Token gets stolen from the Vendor then the token could be used to authenticate to other providers. <\/p>\n\n\n\n
Solutions<\/strong><\/p>\n\n\n\n Conditional Access<\/a>.<\/strong><\/p>\n\n\n\n Microsoft has protection against this using CA only seems to protect employees who are logging in via an Azure AD machine, which all our work computers are.<\/p>\n\n\n\n However, there is another Conditional Access feature that can protect you: Risk-based user sign-in protection in Azure Active Directory – Microsoft Entra | Microsoft Learn<\/a>. With this turned on, a user attempting to connect using the stolen credential from an unusual IP address should trigger an MFA prompt, which the attacker will not be able to complete.<\/p>\n\n\n\n How to break the token theft cyber-attack chain – Microsoft Community Hub<\/a><\/p>\n\n\n\n