Identity & MFA Security Checklist — Lock Down Every Sign-In

Objective

Verify that every sign-in path is protected against credential theft and session abuse — with a concrete, reviewable outcome for each check, not a generic “enable MFA” reminder.

When to use

Run this when: reviewing an account’s security posture, onboarding a new user or service account, after a suspected phishing or credential exposure, or as a scheduled identity review (e.g., quarterly).

Prerequisites

• Admin access to your identity provider (IdP) and your organization’s identity platform.
• Inventory of accounts, including service/privileged accounts.
• A documented sign-in log / audit export capability.

Step-by-step checks

1. MFA enabled

• Every human account has at least one MFA method enrolled — including legacy and rarely used accounts.
• Service and break-glass accounts have a documented exception with compensating controls; exceptions are time-limited and reviewed.
• MFA is enforced by policy, not left to user choice (no “optional” prompt).

2. Phishing-resistant MFA

• Privileged and sensitive accounts use FIDO2/security keys or passkeys, not SMS or one-time codes.
• Where phishing-resistant methods cannot be used, the risk is documented and the account is given compensating monitoring.
• Verify a phishing attempt cannot capture the factor (one-time codes and SMS can be relayed; keys cannot).

3. Password hygiene

• Passwords are long and unique per account — a breach elsewhere must not grant access here.
• No shared passwords between personal and work accounts.
• Password managers are used for stored credentials; browser-only storage is discouraged for sensitive accounts.

4. Recovery methods

• Recovery phone/email is verified and belongs to the account owner.
• Recovery paths cannot be changed without a second factor or admin approval.
• No orphaned recovery email/phone on old domains that could be claimed by an attacker.

5. Session security

• Sessions expire after a defined idle time.
• Sign-in from new devices requires MFA and, for privileged accounts, step-up verification.
• Active sessions are auditable and can be revoked centrally.

6. OAuth / third-party access

• Review granted OAuth apps and revoke anything unused or unrecognized.
• Each grant’s scope is the minimum needed — no blanket “read/write everything” grants.
• No third-party app has delegated admin permissions without a review record.

7. Privileged accounts

• Admin roles are limited to a named, reviewed set of users.
• Privileged accounts are excluded from self-service password reset and bypass-style recovery.
• Privileged sign-in is monitored with alerts for unusual location, device or time.

8. Sign-in monitoring

• Review sign-in logs for: impossible travel, repeated failed logins, new-device logins for privileged accounts, and logins outside normal hours.
• Anomalies trigger a documented response step (verify the user, revoke sessions, reset credentials).
• Audit the last 30 days of sign-in activity as part of the review.

9. Credential compromise response

• On suspected compromise: revoke sessions, force password reset, rotate any tokens/API keys held by the account, and check for new MFA methods or recovery changes added by the attacker.
• Check linked mail rules and forwarding (attackers often add stealthy forwarding).
• Record the incident and escalate to an investigation if data access is suspected.

What indicates risk

SMS-only MFA on privileged accounts, long-lived or non-expiring sessions, broad OAuth grants, admin roles beyond the named set, missing MFA on legacy accounts, and any sign-in anomaly involving privileged identities.

What is normal

Phishing-resistant MFA on sensitive accounts, unique long passwords with a manager, verified recovery paths, expiring sessions, minimal OAuth grants, and sign-in logs with no unexpected privileged logins.

Tools

• Password Security Checker — assess credential strength without transmitting it.
• Email Header Analyzer — verify MFA-enrollment and credential emails are genuinely from the provider.

Evidence

Record per check: account inventory reviewed, MFA enrollment status, recovery paths, active OAuth grants, session policy values, and the date of the sign-in log review — each with the timestamp of the review.

Escalation

Escalate immediately when: an account shows signs of active takeover (new MFA method, changed recovery, mail forwarding added, privileged login from an unknown device), or a privileged credential may have been phished. Treat it as an incident, not a cleanup task.

Mitigation

• Revoke sessions and tokens; reset credentials and rotate API keys.
• Remove attacker-added MFA and recovery entries; restore mail rules.
• Apply compensating monitoring to the affected account and related accounts.
• If phishing was the entry point, run the phishing containment steps and review how the user’s environment was accessed.

Verification

• Confirm the user can still sign in with their own (new) MFA and that attacker-added methods are gone.
• Confirm no remaining broad OAuth grants or mail forwarding rules.
• Re-check sign-in logs for the affected account after 24 hours.

Start a new investigation to track findings, evidence and remediation per account.

References

• CISA — Implementing Phishing-Resistant MFA
• NCSC — Setting up two-factor authentication
• FIDO Alliance — FIDO2
• CISA — Secure Our World