Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Attack Simulator

Copper Contributor

The Attack Simulator appears disabled with a message that says "You must enable multi-factor authentication (MFA) to schedule or terminate attacks." 

 

We have MFA Enabled on just about every account with the exception of a few that are not real user accounts (converted to shared mailboxes). 

 

Does every account have to have MFA enabled in order for this to work? 

4 Replies
best response confirmed by Bryan Kuester (Copper Contributor)
Solution

No. What you need is to have actually performed the MFA challenge before you access the page. It will check the access token for the presence of the "user has performed MFA" bit, and only let you manage the settings if this is true. Think of it as added security for one of the more sensitive features we have in O365.

@Vasil Michev whats crazy is, what if you have conditional access policies applied to your org. MFA doesn't kick in for me when I am at work. So I need to go home and do this part of my job? lol.

 

-g

 

@Greg Hogan 

this is also discussed here 

https://github.com/MicrosoftDocs/OfficeDocs-o365seccomp/issues/439

 

If Conditional access doesn't deem MFA to be a requirement for your given session, then yes you'll be blocked from the page. You might want to use one of the available methods within conditional access to exempt your session during that visit, or temporarily flip to a hotspot, etc.

@Vasil Michev 

It would be great if Microsoft has an online reference/documentation on all MS365/Defender XDR/Purview admin operations that require this "user has performed MFA" bit. I knew about the Attack Simulator based on an onlie documentation, but was caught by surprise in yet another case where I needed to turn on auditing in Purview (start recording user and admin activity) but received an error at the "Complete organizational setup" step.

1 best response

Accepted Solutions
best response confirmed by Bryan Kuester (Copper Contributor)
Solution

No. What you need is to have actually performed the MFA challenge before you access the page. It will check the access token for the presence of the "user has performed MFA" bit, and only let you manage the settings if this is true. Think of it as added security for one of the more sensitive features we have in O365.

View solution in original post