MFA alerts for when a alternative phone number is added

Microsoft 365, through Entra ID (formerly Azure AD), does not offer a native alerting capability to notify administrators when a user adds or modifies an alternative MFA phone number. Changes to authentication methods can be tracked via Entra ID audit logs, and organizations may configure monitoring and alerting through Microsoft Entra Identity Protection or integrate with Azure Monitor and Microsoft Sentinel. Since no built-in feature exists to automatically generate email notifications for these events, a custom detection rule based on audit log entries must be implemented to achieve this functionality.

Learn about the audit logs in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

Set up your Microsoft 365 sign-in for multi-factor authentication - Microsoft Support

Voice call authentication method - Microsoft Entra ID | Microsoft Learn