Emphasizing security by default with advanced Microsoft Authenticator features

robert2709 That is a good idea, receiving suspicious attempt notifications on a pre-registered device on authenticator app. I get notifications when i sign into new apps on personal account and i see on authenticator there is a section for security notifications showing past.

For high-risk employees they should be using privileged access workstations (PAWs) which is easy to verify but non-privileged users can have lighter restrictions, specially if they can't be bound to a single device/location.

HotCakeX Thanks! We are fully using conditional access policies but it is not the holy grail. If you have an international organisation and people need to work from anywhere, any device, you cannot to much restrict both condition of device and/or location. 

So my thought was: if identity protection knows of a risky login, why not notify the user of a risky sign in (either via mail but preferably via the authenticator app).  

I don't think in CA policies you can currently stop logins from atypical /impossible travel events because that would be even better (stops the AiTM as in most cases they originate from entirely different countries).

JG-Burke 

---

I am hoping you can fill-in some gaps here....  How are MFA prompts being sent if the login/password of the user account is not compromised?

---

When your Microsoft account (personal or Entra ID) is password-less, all you need to send an authenticator notification is the email address.

robert2709 

I think what you're looking for is conditional access policies. They do exactly what you mentioned (and a lot more)

What is Conditional Access in Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn

Building a Conditional Access policy - Microsoft Entra ID | Microsoft Learn

Using networks and countries/regions in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn

RichDean570 The notifications do expire yes. The webpage or app that requests them expires them and doesn't wait for the response indefinitely, It usually only waits for 1 minute or so. That has always been my experience both for personal and businesses accounts.

If you suppress these, how do you know when an account has been compromised?

This is a smart addition to making sure MFA is secured, with well managed notifications. Thank you.

Korcel the option is still there as shown in the last picture, but as the users are not receiving notifications for those prompts it'll going to be pure luck if they end up opening the authenticator app at the same time as there is fraudulent MFA prompt waiting. I'm still leaning towards the change being valuable even if it means getting less fraud reports from users. 

Thank you all for addressing these type of problems users face. We all appreciate the efforts. I do have a few questions. 

The article states, "The app serves as a repository for all authenticator notifications". Could these stored notifications be exploited? Have the notifications always been stored in the app? Do the notifications expire? 

Good steps in the right direction. I do think that also alerting the using after opening the request would be a nice feature. i.e. If the login comes from an unknown location/device and does not match with current activity by the user, mention in the request that this request may come from a social engineering attack as is risky.

Otherwise I can already see attackers adjusting their MITM attacks to give the victim instructions to open the authenticator app to enter the number.