Detecting MFA Fatigue and Push Notification Bombing in Microsoft Entra ID

MFA Fatigue (also called MFA Prompt Bombing) occurs when an adversary obtains valid credentials and repeatedly triggers push notification prompts to the user's mobile device. Attackers often flood prompts during night hours until the fatigued user taps "Approve" to silence their phone.

This KQL rule identifies sequences where multiple denied MFA attempts are immediately followed by a successful sign-in.

Table & Data Requirements

• Microsoft Entra ID: SigninLogs

Sentinel Detection Query

// Detect MFA Fatigue: Repeated Denials Followed by Success for the Same User
let timeframe = 2h;
let failureWindow = 30m;
let mfaFailures = 
    SigninLogs
    | where TimeGenerated >= ago(timeframe)
    // 500121 indicates user failed or rejected MFA prompt
    | where ResultType == 500121
    | summarize 
        FailureCount = count(),
        FirstFailure = min(TimeGenerated),
        LastFailure = max(TimeGenerated),
        AttackerIPs = make_set(IPAddress, 5)
        by UserPrincipalName
    | where FailureCount >= 3;
let mfaSuccess = 
    SigninLogs
    | where TimeGenerated >= ago(timeframe)
    | where ResultType == 0
    | project SuccessTime = TimeGenerated, UserPrincipalName, SuccessIP = IPAddress, SuccessLocation = Location, AppDisplayName;
mfaFailures
| join kind=inner (mfaSuccess) on UserPrincipalName
| where SuccessTime between (LastFailure .. (LastFailure + failureWindow))
| project UserPrincipalName, FailureCount, FirstFailure, LastFailure, SuccessTime, AttackerIPs, SuccessIP, SuccessLocation, AppDisplayName
| order by FailureCount desc

How It Works

1. Isolate MFA Denials: We identify accounts encountering repeated ResultType == 500121 within a tight window.
2. Inner Join on Success: We correlate those failures with a subsequent successful login (ResultType == 0) occurring within 30 minutes of the final prompt rejection.
3. IP Comparison: In real compromise scenarios, the AttackerIPs and SuccessIP may match, or the success may originate from the attacker's proxy while the denials originated from automated scripts.

Enterprise Hardening Recommendations

• Enable Number Matching in Microsoft Authenticator (now enforced by default in Entra ID).
• Implement FIDO2 WebAuthn security keys or Windows Hello for Business to eliminate push-based attack vectors entirely.

MITRE ATT&CK Mapping

• Tactic: Credential Access (TA0006)
• Technique: Multi-Factor Authentication Request Generation (T1621)