A MFA fatigue attack is where an attacker will constantly attempt to login as the user causing an MFA request to appear on the users device. If this request is simply to deny or approve, and with enough requests, the user eventually approves to make theses requests go away. Such an attack recently provided very successful at Uber. You can read more about that incident here:
https://www.uber.com/newsroom/security-update
With MFA in Microsoft 365 and the Microsoft Authenticator app you can avoid this by enabling number matching for push notifications. Here’s how to do it:
Navigate to the Azure portal as an administrator and then to Azure Active Directory. Here, select Security from the menu on the left as shown above.
Here, select Authentication methods as shown above on the left.
Now select Microsoft Authenticator on the right.
Select Configure at the top of the page and ensure all the options listed are Enabled for all users. You may want to exclude any break-glass accounts though.
Back on the Basic tab, as shown above, ensure you have Enable set to Yes and you target all the desired users with Passwordless.
Now, when users are prompted for MFA they will see the above on their devices and need to type the number that is on the screen into their device to approve the login. They will also see the geographic location the request came from and application requesting as shown above.
If you want to check yoru environment for MFA fatigue attacks you can use this KQL query in Sentinel:
Online security is something that requires constant adjustment as the bad actors adapt to the protection methods put in place. Number matching in Microsoft 365 is quick and easy to set up using the Microsoft Authenticator and the recommended approach you should take to avoid MFA fatigue attacks.
CIAOPS 
One thought on “Avoid MFA fatigue attacks in Microsoft 365”