Suspicious Login Issues

How to Investigate Spoofed Emails in Microsoft 365 Despite MFA

Maira Mehtab Sep 20, 2026 868 views

Question details

A staff member received an email that appears to be from a company executive, but the sender and message headers show discrepancies, despite the organization enforcing multi-factor authentication (MFA).

Product: Microsoft 365
Device & OS: not provided
Scenario: Investigating potential email spoofing and verifying account security when multi-factor authentication is active.
Observed behavior: An email was received spoofing an executive's identity, with slightly differing message headers and sender information compared to legitimate emails.

Before you start

Ensure you have administrative access to the Microsoft 365 Admin Center and the ability to run message traces before beginning your investigation.

Solution 1Recommended

Analyze Message Headers and Authentication Results

Check the full email headers to determine the true origin of the message and see why authentication-source headers might vary.

Authentication-source headers can vary due to server routing, different authentication methods, multiple Exchange servers in the path, or recent configuration changes. Thoroughly reviewing the complete headers helps distinguish a spoofed email from a legitimate one.

Open message properties

Open the suspicious email in your email client and access the message properties or details to view the full Internet headers.

Analyze the headers

Use a message header analyzer tool to parse the header data and locate the 'Authentication-Results' and 'Received' fields.

Check for discrepancies

Look for discrepancies in the originating IP address and domain compared to your organization's known infrastructure.

Header Variations: Keep in mind that headers might legitimately vary if the sender used a third-party service or a different Exchange server.

Solution 2

Enable and Verify SPF, DKIM, and DMARC

Strengthen your domain's email security to prevent unauthorized senders from spoofing your organization's domain.

Solution 3

Investigate Sign-in Activity and Contact Support

If you suspect an actual account compromise despite MFA, review the user's sign-in logs and escalate the issue.

Free Microsoft Office alternative

Secure and Manage Your Documents with WPS Office

While Microsoft 365 handles your complex email infrastructure, WPS Office offers a lightweight, highly compatible alternative for your daily document creation needs. Enjoy seamless productivity without the heavy subscription costs.

1. Download the installer: Visit the official WPS Office website to download the free installer.
2. Install the software: Run the installation file and follow the on-screen instructions.
3. Start creating: Open WPS Office and start creating or editing your documents immediately.

Fully compatible with Microsoft Office file formats (.docx, .xlsx, .pptx).Free to use with a familiar, easy-to-navigate user interface.Lightweight installation that doesn't slow down your device.Built-in PDF editing and secure document sharing tools.

microsoft office alternative - wps office

Frequently Asked Questions

Can emails be spoofed even if the organization uses MFA?

Yes, MFA protects the user's account from unauthorized logins, but email spoofing typically occurs when an external attacker forges the 'From' address without actually logging into the compromised account.

Why do authentication-source headers vary in legitimate emails?

Variations can occur due to server routing paths, different authentication methods, the use of multiple Exchange servers, or third-party marketing services authorized to send on behalf of the domain.

What is the difference between SPF, DKIM, and DMARC?

SPF verifies the sender's IP address, DKIM adds a digital signature to ensure the email hasn't been tampered with, and DMARC uses both to provide instructions to the receiving mail server on how to handle failed authentication checks.

How do I access message headers in Outlook?

In Outlook desktop, double-click the email to open it in a new window, go to File > Properties, and review the text inside the 'Internet headers' box at the bottom of the window.

Microsoft Office Security Issues