We have a serious issue to secure Sharepoint Online.
We require (and configured) the use of MFA with the Authenicator-app or sms. We have configured sign out inactive users and don't give the option to remain signed in. SharePoint must enforce these
This is important for us because we have to support unmanaged client devices, users don't logon on to their device and share their device like internet cafe PCs.
This all works very well in a browser based environment.
If a user is authenticated and authorized with his browser to SharePoint, he is able to open a sharepoint managed document with his local Office app (Word). Once he does this his account and credentials are added to Connected Service on the local machine.
Never is asked for the MFA verification, inactive users are never signed off, so every user who has access to this unmanaged machine has access to or documents on SharePoint Online.
We cannot believe that this is by design, what should be done that MFA, sign out inactive users is effective for these users too. Please help, we can't go live with this serious security issue.