I don't view this as "produced defective product", but rather as an escalation in an ongoing arms-race. As the adversary continues to evolve, so must the defenses. In this particular example, I have to believe that Microsoft is following their own advice and blocking risky access to login.microsoftonline.com itself, beyond just asking customers to beef-up their IdP.
This scenario makes me glad to have defense-in-depth. I have a SAML/MFA provider for authentication, an email filtering service to detect spam/phishes, and a web filter to detect malicious web sites. All three layers are from different manufacturers, and all would need to fail for this particular attack to succeed.
That said, there is also the theory that one should not let a good crisis go to waste. Now that the trade rags have alerted my bosses to weaknesses in the auth layer, it is a good time to propose tweaking up the nerd-knobs on the email and web layers. And who knows, I might just "forget" to turn them back down after MS has deployed their mitigation.
