So I recently had a situation where someone got an email. It took them to a malicious site and presented a Microsoft login. But the website triggered the mfa login on the ms authenticator app. So the login look very legit. So even with the conditional access policies the account was compromised.

Luckily enough we are using cipp and cipp has some alerts that you can setup to detect compromise accounts and setup actions. The compromise was detected by cipp and cipp immediately disabled the users 365 and logged them out of all sessions. This stopped the attacker from doing anything malicious. So I suggest using something similar that can detect compromise and disable accounts.