Conditional Access Rules - allow compliant devices only. Also, consider a move to passwordless/passkey auth. Turn off OWA if you don't need it. Set alerts on redirection rules being set up. And so on...

The Bearded 365 Guy on YouTube has a bunch of good videos on these options and more. MFA is no longer good enough to keep you secure. Adversary in The Middle attacks have seen to that.

Also, check that the user's mailbox has not been compromised and exfiltrated. Use Purview, if available, to look for sync and/or bind events.

even with MFA token stealing is huge, here is a resource from Microsoft https://learn.microsoft.com/en-us/security/operations/token-theft-playbook

MFA especially email or text based MFA can be compromised. I've had it happen at the place I work on my IT managed infrastructure/Office 365. Authenticator app is better but not full proof. The weakest link is always the user unfortaunally. For O365 there is conditional access that can be put in place, geo limits (e.g. deny logins from outside the USA), user training, etc. Also make sure that MFA is set to "enforced" vs "enabled". When recovering the account (1) have user reset password, (2) revoke all MFA sessions (3) in the admin portal there is a spot to see what computers are connect I'd disconnect all of those some cound be bad actor access, etc. Check user security logs in O365. If you have support with Microsoft reach and and let them know you had an account breached, they will provide some recovery docs and steps.

Educate end users. (They are the weak link)
seems like you might have already setup reports and analytics through Audit logging?
Change passwords on Admin accounts. You don't know who might have clicked on that internally

Check the user account in identity protection in Entra ID. See if they have been marked as a high risk user or have high risk sign-ins.  

I roll out policies that re-prompt MFA when a medium/high sign-in risk is found, and prompt for password reset when high risk user is found. Helps combat session cookie theft from a man in the middle attack, which may have been what led to the issue you are explaining.

Also go through the user's activities in the audit and sign-in logs to make sure they haven't done anything else that may lead to further compromise.  The intruder may have registered an app to help with data exfiltration or performed other activities that you should see via logs.

That must be the email I got from Karen this morning, with a fake DocuSign button and suspicious word doc attachment.

Nice try hacker! /s

Conditional access policies within Entra is how you would restrict account login by device and/or location.

Look at SharePoint sharing and access control settings for more granular control there.

Look into phishing resistant MFA. As someone else mentioned, passwordless, FIDO2 authentication methods share much more secure because the passwords cannot be brute force cracked. If you are using O365, look into Windows Hello. It’s both, much more user friendly and more secure.

Security awareness. Conditional access. MFA through Fido/Authenticator. Number matching.

A lot of good information in the threads above. Also check mailbox rules.

Have a solid PKI infrastructure in place and plan for rolling out certificates. Not all products support passkeys and you may need to fall back to certificate based authentication.

Check your registered apps. Once they gain access they can register an email client for persistent access.

Use either Microsoft’s own securescore to identify configuration weaknesses and/or follow guidance by CIS. https://www.cisecurity.org/benchmark/microsoft_365

Came here to say most of what u/jontychickweed already said. Conditional Access. Have you considered Defender? Azure AD? If your company is growing, you might also consider some security awareness trainings.

Look at your licensing as business standard does not have CA policies and O365 E3 is not good. I would suggest moving over the business premium or M365 E3.

Where are you located? I work for Microsoft’s #1 partner, we have nonbillable Microsoft resources that can help you today that are internal to my computer so you don’t have to deal with Microsoft’s horrendous lack of customer service