1Password MFA disabled
Description
AlphaSOC detected removal of built-in or Duo multi-factor authentication (MFA) from a 1Password user or the account. MFA removal weakens the account's authentication controls and can make unauthorized access easier.
Impact
Without MFA, an attacker who obtains a valid password may be able to sign in to the affected account without the additional verification normally required. A compromised 1Password account can expose the credentials and sensitive items stored in its accessible vaults.
Severity
| Severity | Condition |
|---|---|
Medium | 1Password MFA disabled |
Investigation and Remediation
Review the audit event to determine whether MFA was disabled for an individual user or the entire account and identify the acting user. Verify the change against approved support or recovery activity. If it was unauthorized, re-enable MFA immediately, revoke active sessions, reset or rotate affected credentials, and investigate recent account and vault access.