These last mentioned second factor methods (SMS & Voice Call) are in my opinion the least secure and least user-friendly options of all the MFA methods available today (due to for example potential SIM-hijacking). However, where we as IT administrators would rather encourage users to use the Microsoft Authenticator App, users are still choosing less modern and user-friendly scenarios to handle their second factor sign-in, such as SMS or Voice calls. With number matching enabled, it will be much harder to accidentally approve a malicious MFA prompt.Nowadays we see lots of environments being secured with Azure Multi Factor Authentication, which is great. For example, an account was compromised using this technique and was then used to send fake job ads through Canvas’ internal-messaging system. Metropolitan State University of Denver’s Information Technology Services Security Team has seen multiple users fall victim to MFA fatigue.

Some users may approve one of these fraudulent notifications out of frustration, but others may accidentally approve a fraudulent notification while trying to accept a legitimate one. These attacks, also known as “push bombing,” occur when a cyberthreat actor uses stolen login credentials to bombard a user with mobile-app push notifications.

Microsoft is implementing this feature to combat a rise in multifactor-authentication fatigue attacks. Center for Equity and Student Achievement.

Microsoft mfa app