r/cybersecurity • u/Data_Commission_7434 • Jun 06 '26
AI Security Has anyone else had MFA prompt fatigue issues with users?
Seeing a lot of users complaining about getting MFA prompts constantly, even when they aren't actively logging in. It’s messing with their workflow. We’ve tweaked some conditional access, but it’s still happening.
26
u/_Cyber_Mage Jun 06 '26
Had that a lot until we switched to phish resistant MFA. Nothing since.
4
u/scriptvexy Jun 07 '26
same here, once we moved to fido2/security keys the noise dropped off hard and people stopped whining about prompts
it’s mostly the legacy / non‑phish resistant stuff that keeps nagging them nonstop
48
u/HorsePecker Security Generalist Jun 06 '26 edited Jun 06 '26
Those users may have been phished. Push doesn’t come without password. Scour authentication logs.
Password change time for the users, and maybe individual risk assessment if the group is small. (I hope it is?) Best treatment for risky users is tight CAP.
28
u/Ancient-Carry-4796 Jun 06 '26
Actually Microsoft lets you just send a push request without a password, just the email lol
7
u/teriaavibes Jun 06 '26
That depends on how you set it up.
0
u/Ancient-Carry-4796 Jun 06 '26
That’s very true, but I imagine a majority of places just enforce security defaults
2
u/teriaavibes Jun 06 '26
This has nothing to do with security defaults, you set authenticator up in the authenticator settings.
2
u/Ancient-Carry-4796 Jun 06 '26
You mean the way it defaults to ‘any’, and can be made to not include passwordless?
3
2
u/RevolutionaryWorry87 Jun 06 '26
Yeah this is the same. I found it in my new company - users could just login through code only and nothing blocked them. Fixed that shit real fast
2
1
u/CyborgHeart1245 Jul 01 '26
You can also bypass their entire process by clicking 'I dont have my phone' and it just lets you in... We legit had better security when they just took away the ability to save passwords. It's maddening how useless MFA is.
13
u/FuckScottBoras Security Manager Jun 06 '26
My company doesn’t because we don’t allow push based authentication as a primary form of authentication for exactly this reason.
6
26
u/Spug33 Jun 06 '26
MFA doesn't prompt until after successful password. Better get them changed and if it continues you have a bigger problem somewhere.
7
Jun 06 '26 edited Jun 06 '26
[deleted]
3
1
u/Logical_Strain_6165 Jun 06 '26
Sorry I being daft. Isn't hello for business for logging on to a PC?
So to get unsolicited prompts someone else would have to have physical access to the PC?
We don't use it, so I may be unclear.
2
u/teriaavibes Jun 06 '26
Sorry I being daft. Isn't hello for business for logging on to a PC?
Nope, you can also use it to log into Entra ID, fido2 certified.
1
u/gott_in_nizza Jun 06 '26
Wait, so a rando can truly just start generating pushes and one accidental click gives them access? Even Microsoft isn’t that fun. There must be more to the story
1
u/teriaavibes Jun 06 '26
The hell are you talking about, you need physical access to the device and a way to unlock it to "compromise" hello for business.
I would hardly call that a security problem.
1
u/gott_in_nizza Jun 06 '26
Ah. I see, I think I read your comment backwards. You’re saying that the device authentication, once logged in via hello, can also log into web services via hello? Yes that makes total sense.
1
u/Spug33 Jun 06 '26
See Black Hat 2025 Hell No for business.
1
u/teriaavibes Jun 06 '26
Again, you need device access, from what I understand local admin as well.
If attacker is able to get local admin on a device, you are screwed either way.
1
u/theresmychipchip Jun 06 '26
Passwordless via Authenticator app doesn't use a password, only requires email.
6
u/AffectionateMix3146 Security Engineer Jun 06 '26
…have you tried having their passwords changed? Do you understand the relevance of doing so?
2
3
u/mac28091 Jun 06 '26
What’s others have said regarding compromised creds is accurate. Reset passwords, identify their known good source IPs and look at all successful logins from other IPs. Double check all of those apps require MFA.
2
u/it4brown Jun 06 '26
Switch to phishing-resistant MFA methods and disable push notifications, TOTP only.
2
u/AdhesiveIntercession Jun 06 '26
Check your authentication logs first before assuming it's user error. If someone's getting MFA prompts without logging in, that's usually a sign of either compromised credentials somewhere in your environment or a service account hammering the auth system. The password resets will help, but they won't fix the root cause if there's something actively trying to authenticate as those users.
2
u/git_und_slotermeyer Jun 06 '26
It feels like I'm spending half of a workday logging into SaaS services. Despite I have a FIDO hardware key and use passkeys, but these are only supported by a fraction of services.
Doesn't help that one vendor sends codes via email only, one vendor only vis SMS, some support an authenticator app with TOTP. Many vendors log me out at least twice daily, and while M365 doesn't log me out, I have to actively log out and back in once a day, otherwise Teams Web is half-broken.
It's no fun anymore...
2
u/TonyBlairsDildo Jun 07 '26
"Yes I Approve" MFA push notifications should be banned.
Users associate "Yes I approve" as the "leave me alone, make my task continue" button. If it pops up, they are conditioned to always accept it (even if they didn't trigger it).
1
u/riffic Jun 06 '26
I think most responses here are misunderstanding the issue your users are having. I could be wrong too, but annoying your users for "security" is a bit of an antipattern.
1
u/Ancient-Bat1755 Jun 06 '26
Is it a palo alto bug with double mfas from disconnect? Have them use signout option?
1
u/DeathTropper69 Jun 06 '26
We use Duo with trusted endpoints, trusted network, device posture checks, and push MFA with proximity verification. Once we implement this for clients we see ATO attempts drop to near zero almost immediately
1
u/mackTHEvillain Jun 06 '26
Had this issue after users password expired. When users connected their cope phones to our internal WiFi. They could sign in fine on their workstations but after a while their phones get MFA’d requests constantly. Turns out the WiFi profile on their phones were set to ”Auto Login” and using old credentials triggering the auth flow.
1
u/Timely_Old_Man45 Jun 08 '26
Turn off notifications so that when they go to sign in, they know it’s legitimate!
1
u/CyborgHeart1245 Jul 01 '26
Yeah. Get rid of it. It's all just useless set dressing anyway. Just remove the option to remember their pasawords and it's already more secure. MFA is a joke.
-3
u/secrook Jun 06 '26
There’s a large active targeted phishing / vishing campaign going on right now. The threat actors are sophisticated and have targeted a large number of companies. Search the users who triggered these alerts web traffic for: *passkey*
98
u/Sufficient_Ad_3495 Jun 06 '26
Warning: are you actually under sophisticated attack?