Home

Notify User of MFA Failure

%3CLINGO-SUB%20id%3D%22lingo-sub-266949%22%20slang%3D%22en-US%22%3ENotify%20User%20of%20MFA%20Failure%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-266949%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3B%20I%20am%20searching%20high%20and%20low%20for%20a%20way%20to%20send%20a%20notification%20email%20to%20a%20user%20when%20an%20MFA%20failure%20occurs%20for%20their%20account.%26nbsp%3B%20So%20far%20all%20I%20can%20find%20is%20in%20Cloud%20App%20Security%20where%20I%20was%20able%20to%20create%20a%20policy%20match%20for%20MFA%20failure%20alerts%20and%20send%20an%20email%20to%20our%20admin%20group%20but%20what%20we%20want%20to%20do%20is%20notify%20the%20USER%20if%20THEIR%20account%20has%20an%20MFA%20failure%20event.%26nbsp%3B%20I%20tried%20Flow%20but%20there%20doesn't%20seem%20to%20be%20any%20triggers%20for%20Cloud%20App%20Security%20or%20MFA%20at%20all%20and%20I%20am%20not%20versed%20in%20writing%20custom%20triggers%20with%20API%20calls%20etc..%20Does%20anyone%20have%20any%20insight%20on%20the%20ability%20to%20send%20this%20type%20of%20notification%20email%20on%20MFA%20failure%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-266949%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Active%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMulti-Factor%20Authentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%20Center%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Tom Garner
Occasional Visitor

Hello,

    I am searching high and low for a way to send a notification email to a user when an MFA failure occurs for their account.  So far all I can find is in Cloud App Security where I was able to create a policy match for MFA failure alerts and send an email to our admin group but what we want to do is notify the USER if THEIR account has an MFA failure event.  I tried Flow but there doesn't seem to be any triggers for Cloud App Security or MFA at all and I am not versed in writing custom triggers with API calls etc.. Does anyone have any insight on the ability to send this type of notification email on MFA failure?