[RKDinOKC]

AND, If you let them reset their own password it ends up being their name, or someone in their family and their birthdate.

Our compromised users lately have been sales people using Microsft Dynamics CRM. It tells you to Log Out and close your browser window. But they don't and get their login info jacked from the browser cache. To make matters worse we are going to On-line Sharepoint which is all browser access and even more likely to get jacked leaving all your files accessible, yikes.

We have only turned on Multi-Factor Authentication for the users that have already been hacked. Closing the gate after the livestock has gotten loose. I want to limit the IP addresses users can access our hosted microsoft from. But they don't want to do that.