Best remediation steps for MFA session hijacking attacks?

With the rise of pass-the-cookie / AiTM attacks to bypass MFA, I’m looking into best practices for defense against these attacks, but also remediation steps to add to our incident response plan when (not if) it happens in our tenant.

For security controls, Azure Identity Protection risk policies paired with Conditional Access session controls is already in place. Blocking access on unmanaged devices as well.

Alert monitoring in Defender 365 for Cloud Apps too.

Is there a way to automatically …

access actions aitm alert apps attacks azure best practices blocking bypass cloud cloud apps conditional access controls cookie cybersecurity defender defense devices hijacking identity identity protection incident incident response incident response plan mfa monitoring policies policy practices protection remediation response response plan risk security security controls session session hijacking tokens unmanaged devices valid