Can anyone point me to some info on the authentication steps for Azure AD and MFA. Basically trying to determine during the login process the person first enters their username and password and submits. They are then prompted through the chosen method to accept a MFA prompt. My question is does the MFA prompt sent before or after the username and password is validated as correct.
For example if I see in the Azure AD sign ins a login that failed due to MFA not being accepted. Can I assume that the username and password was already validated as being correct and it moved onto MFA which failed or are they all validated at the same time?
@Cary Siemers thanks that's my observation. I suppose I was hoping this might be documented somewhere so I can show managers this is the case as I am being challenged if a users credentials have been compromised or not.
Any idea if there is a article from MC confirming this?