Coverage claims often assume the wrong protocol surface.

MFA policy may be correctly enforced for modern authentication while older protocols, service exceptions, or overlooked application paths still allow weaker access. The issue is usually control scope, not whether MFA works at all.

Prove where the control begins and ends.

• Identify which protocols and clients are in scope for the current MFA design.
• Review application and service account exceptions that bypass the intended flow.
• Check whether legacy auth remains enabled for compatibility reasons.
• Confirm whether logs distinguish modern and legacy paths clearly enough to trust the conclusion.
• Test with the same client type and auth method used by the suspicious access path.

Close the gap without breaking legitimate workflows blindly.

• Inventory legacy protocols and the dependencies that still require them.
• Prioritize blocking or isolating the highest-risk paths first.
• Stage replacements for workloads that still depend on older auth methods.
• Retest using real client behavior, not assumptions from policy screens alone.