You revoked the session. But did you check if the attacker registered their own device?
One of the things I brought home from Workplace Ninja Summit in Baden was how much the device actually matters to the identity. We talk a lot about MFA, passkeys, Conditional Access, and tokens. But the device isn’t just something the user sits in front of when they sign in. The device can itself become part of the trust chain. That point was clear across sessions on modern identity attacks, device trust, passkeys, and privileged workstations. Shortly after the conference, concrete attacks made the issue far less theoretical. ...