Contact the User
Confirm whether the user initiated the authentication attempts and determine whether they approved any unexpected prompts.
← Back to Engineering NotebookMFA Fatigue:
Security Operations
MFA Fatigue:
Containment and Response
Repeated MFA prompts that a user did not initiate should be treated as a potential identity-security incident, not simply an annoying authentication problem.
IdentityMFAIncident ResponseMicrosoft Entra IDAuthentication
Scenario
The User Says:
“I Didn't Do That.”
A user reports receiving repeated MFA prompts even though they are not actively signing in. The immediate temptation may be to troubleshoot the authenticator application or assume the prompts are accidental.
But an unexpected MFA request may indicate that someone is attempting to authenticate using the user's identity and has reached the MFA stage of the sign-in process.
At that point, the issue should be treated as a potential identity-security incident rather than routine authentication support.
First Response
The First 15 Minutes
The early objective is to establish whether the activity is legitimate, reduce the chance of continued access, and preserve enough evidence to understand what happened.
Contain the Account
If the prompts were not initiated by the user, treat the activity as suspicious and begin containment before continuing normal troubleshooting.
Review Authentication Activity
Examine recent sign-ins, authentication attempts, locations, devices, applications, failures, and other available identity signals.
Invalidate Existing Access
When compromise is suspected, revoke active sessions and require fresh authentication so existing access cannot simply continue.
Investigation
Questions the Evidence Should Answer
The goal is to reconstruct what the identity was doing rather than relying only on the user's memory of the prompts.
01
Was the MFA request initiated by the user?
02
Did the user approve any unexpected authentication prompt?
03
Are there successful sign-ins from unfamiliar devices or locations?
04
Are repeated failures coming from the same source?
05
Was a new authentication method recently registered?
06
Did the account access applications it normally does not use?
07
Are other users showing similar authentication behavior?
08
Is there evidence that credentials may have been exposed elsewhere?
Response Lifecycle
Contain. Investigate. Recover. Improve.
Contain
Stop potentially unauthorized access before spending too much time investigating the full story.
Investigate
Review identity activity and determine whether the event represents failed abuse, successful compromise, or legitimate behavior.
Recover
Restore normal access only after credentials, sessions, MFA methods, and account state have been reviewed.
Improve
Use the incident to identify policy, training, monitoring, or access-control changes that could reduce future risk.
Operational Context
Security Still Has to Support the User
In an operational environment, an account may be tied to email, property systems, collaboration tools, file access, and other services the user needs to perform their job.
That does not mean containment should be delayed. It means the response should include communication, ownership, recovery planning, and an understanding of what business processes may be affected.
The objective is not simply to lock an account. It is to reduce risk, understand what happened, and safely return the user to normal operation.
Lessons
What This Scenario Reinforces
01
Repeated MFA prompts should not automatically be treated as a routine user-support issue.
02
Repeated unexpected MFA prompts can indicate that an attacker has reached the second stage of authentication, but sign-in evidence is needed to determine what actually occurred.
03
Containment and investigation should happen in parallel when identity compromise is plausible.
04
User confirmation is important, but identity logs provide the technical evidence.
05
A resolved incident should leave behind documentation and a stronger control environment.
Takeaway
An MFA Prompt Can Be an Incident Signal
MFA is an important control, but an unexpected prompt can also become a useful security signal. Authentication requests the user did not initiate should trigger validation, investigation, and a response proportional to the evidence.