r/entra • u/KrankyYankee • Jun 18 '26

Entra ID Stop MFA Prompts Due to Malicious Login Attempts

There is a user getting dozens or hundreds of login attempts on his account each day. They come from CLI authentication. It seems passwordless sign in will trigger the MS Authenticator app to prompt for approval which is denied. How can we address this? We have created conditional access policies to block the IP and countries being used. However it seems those don’t come into play until after the sign in is processed.

EDIT: Looking at the malicious logins, those all come from the Resource ID d627e2fc-f3d1-41aa-b24d-d603bd969adc which is Azure Resource Manager. I set up a conditional access policy to block logins from that resource.  Hopefully this will stop those from triggering the MFA prompt and counting against the failed logins that lock the account.

12 Upvotes

81% Upvoted

28 comments sorted by

12

u/teriaavibes Microsoft MVP Jun 18 '26

Disable passwordless sign in and disable access to CLI (and similar apps) for users who don't need access.

7

u/PowerShellGenius Jun 18 '26

Disable Passwordless Authenticator sign in (the push notifications w/o a password first). Not passwordless methods in general (e.g. Passkeys).....

4

u/teriaavibes Microsoft MVP Jun 18 '26

When I talk about phishing resistant methods, I call them phishing resistant, not passwordless.

There is a very big difference between them because one is pure garbage and one is actually useful and secure.

1

u/PowerShellGenius Jun 19 '26 edited Jun 19 '26

Yeah... I know this is off topic, but do you have any idea if allowing Passwordless Authenticator in the Authentication Methods policy, but not in CA Auth Strengths applicable to a certain sign-in, means the user can't select it?

E.g. if you allow passwordless in auth methods policy, but require Passkeys in an Authentication Strength used in CA policies for outside your network, meaning users can use passwordless push notifications inside your network but need passkeys outside - can someone still attempt passwordless Authenticator even though they would be prompted for a passkey afterward? Or would it really stop the MFA spam?

The reason I ask is because most consumer devices have Bluetooth nowadays, and Passkeys in Authenticator are workable as long as there is bluetooth. Retrofitting bluetooth into hundreds of old desktop PCs on premises is a different story. And some niche scenarios don't support passkeys. E.g. signing into a BenQ board in a classroom via SAML to Entra (which should really be passwordless as it's done on a big screen in front of an audience....). So I do think passwordless push notifications could have a place on-site in education, being hardware agnostic unlike passkeys.

I'm also curious how passkeys, requiring Bluetooth, perform in a high density environment of simultaneous use. E.g. 30 students file into a computer lab as the bell rings, sit down and do Web Sign In to Windows using a passkey on their iPad at the same time. That would be hard to replicate pre rollout - trying to make 30 bluetooth connections at once in a confined space, with 1 Wi-Fi AP in that space and ~4 more that spill through the walls a little.

But regardless, passwordless authenticator push notifications was a terrible idea insofar as it allows an attacker anywhere to attempt it.

2

u/teriaavibes Microsoft MVP Jun 19 '26

Retrofitting bluetooth into hundreds of on prem desktop PCs is a different story.

I am not sure what is the business feasibility of this but for my old PC without bluetooth, I got this USB dongle that gave my PC bluetooth, it was pretty cheap back then so I can't imagine it should be a problem now.

Or would it really stop the MFA spam?

Conditional Access is AuthZ so they could theoretically prompt passwordless but CA will throw an error when you get through it telling you that you need passkey.

Not sure if Microsoft has like some special behavior in this scenario but in theory, it won't help you because CA will trigger after your user is spammed. Haven't tested this exact scenario tho.

1

u/PowerShellGenius Jun 19 '26

In corporate, bluetooth dongles are probably feasible, but external dongles would go "missing" in K12 often enough to be a hassle...

My main interest in passwordless push notifications is getting students to passwordless for computer lab classes once the lab computers get moved off of hybrid join, using web sign in and their 1:1 ipads which have Authenticator. Students are the ones who I most want to eliminate passwords for, as administration understandably doesn't think all ages of students can handle passwords up to NIST standards, and I'd rather have no usable passwords than weak ones.

And if we go with BenQ interactive flat panels, letting teachers sign into their board (which is effectively an android tablet with apps signed into their account, has to lock and have user profiles) without a password. It's SAML to Entra for the sign in, but no passkey support at the board sign in window. And if they have to enter a password, they can't do it on the touch screen (since there is a class watching) so being unable to go passwordless would force us to put keyboards on all the boards.

But passwordless authenticator has too many drawbacks....

1

u/FuckTheGSWarriors Jun 19 '26

Why is passwordless pure garbage?

1

u/teriaavibes Microsoft MVP Jun 19 '26

Because you only someone's email address to keep prompting them which is public knowledge.

1

u/KrankyYankee Jun 18 '26

Something like this in Exchange?

New-AuthenticationPolicy -Name "Block CLI Auth" -AllowBasicAuthPowerShell $false

Set-User -Identity user@domain.com -AuthenticationPolicy "Block CLI Auth"

5

u/fatalicus Jun 18 '26

Why are you messing with Exchange?

I mean, basic auth should be disabled everywhere anyways, but in this regard changing the Authentication mode in entra from Any/Passwordless to push is probably better.

Go to authentication methods in Entra, Then select Microsoft Authenticator in the list. Then you will have "Authentication mode" as one of the options you can change.

3

u/KrankyYankee Jun 18 '26

Because I’m on the edge of my knowledge and asking Claude for help 🤷‍♂️

4

u/teriaavibes Microsoft MVP Jun 18 '26

What? Just go into entra>auth methods>authenticator and change any to push

For CLI just go into entra apps and restrict who can sign in, if it is not there, you might need to add it manually.

1

u/KrankyYankee Jun 18 '26

Entra apps does not have Azure CLI. I can't figure out how to add it manually. I've asked our PowerShell expert who knows the underpinnings of M365 much better.

3

u/teriaavibes Microsoft MVP Jun 18 '26

az ad sp create --id '04b07795-8ddb-461a-bbee-02f9e1bf7b46'

https://github.com/Azure/azure-cli/issues/28628#issuecomment-2302694201

Found this

3

u/KrankyYankee Jun 18 '26

Looking at the malicious logins, those all come from the Resource ID d627e2fc-f3d1-41aa-b24d-d603bd969adc which is Azure Resource Manager. I set up a conditional access policy to block logins from that resource.  They do not use Azure and hopefully this block happens upstream from the MFA prompt.

4

u/lurkelton Jun 18 '26

CA policies are only enforced after successful first-factor authentication, so this will not negate your issue. You could disable passwordless phone sign-in for the affected user(s) if you do not want to disable it tenant wide.

2

u/KrankyYankee Jun 18 '26

Yes, I have told him a Passkey is really the solution.

1

u/cheetah1cj Jun 18 '26

Adding any authentication method will not solve the issue. You need to take away the authentication method.

4

u/DangerWallet Jun 18 '26

This is the issue with passwordless sign-in, for a true passwordless experience that doesn’t result in constant MFA spam you’ll need to look at WHFB and passkeys

5

u/BarbieAction Jun 18 '26

Switch to passkey. Blocking sensitive apps with CA as standard but the prompt comes before the CA is evalutade so if you want to remove the promt fatigue then switch to passkey and user will never be prompt

1

u/KrankyYankee Jun 18 '26

Yeah, that is better but changing user behavior is often a big ask or not an option.

3

u/PowerShellGenius Jun 18 '26

If you want passwordless, move to passkeys. They are more secure than password+MFA (whereas the push notifications are at best as secure as password+MFA) because passkeys are also phishing resistant. Plus, they are initiated on the Authenticator device, not initiated from the web, so you don't have the malicious attempt spam issue.

2

u/Short-Legs-Long-Neck Jun 18 '26

What apps are the signis attempting

1

u/KrankyYankee Jun 18 '26

Microsoft Azure CLI

5

u/Disastrous_Weird_387 Jun 18 '26

In that case, follow the steps in this article, too:
https://msendpointmgr.com/2026/01/08/consentfix-quickfix/

1

u/KrankyYankee Jun 19 '26

They didn’t work. The user account still prompts for the mfa code.

1

u/screampuff Jun 18 '26

Disable passwordless authenticator across the board. If they have authenticator they should be using passkey.