What do repeated MFA denials indicate and how do you detect MFA fatigue in Microsoft Entra ID?

What repeated MFA denials usually mean

Repeated denials are often a sign that someone is trying to wear the user down rather than break the factor itself. In microsoft entra id, that pattern usually means push bombing or MFA fatigue: the attacker keeps sending prompts until the user approves one, or until the noise hides a real compromise path elsewhere in the account.

What makes the signal useful is the context around the denials. A few failed prompts during a normal workday can be noise, but a cluster of denials tied to an unfamiliar login attempt, a new device, or an unusual location is much more concerning. That combination often means the attacker already has a password or session foothold and is now trying to force approval.

Repeated denials should also make you consider whether the account is being targeted as part of a broader identity attack, not just a single MFA event. If the same user later shows a successful sign-in from a different geography, legacy protocol use, or an unexpected device, the denials may have been the visible warning before access was obtained.

How to spot MFA fatigue in Entra sign-in telemetry

The most reliable detection approach is to correlate approval patterns with sign-in context, not to look at MFA events in isolation. A useful review set includes bursts of push requests against one user, repeated denials over a short window, and a final approval that does not match the user’s normal behaviour. The account often shows an unusual source IP, country, device posture, or time of day alongside the prompt storm.

Detection becomes stronger when you compare the MFA activity with the identity’s baseline. If a user usually signs in from one region during business hours and suddenly receives many prompts overnight from another region, that is materially different from a routine access challenge. MFA Guide is a useful reference for separating normal MFA use from fatigue, relay, and token-theft patterns.

in microsoft entra id, the practical indicators are the combination of authentication method details, location, device, and sign-in frequency. You want to identify whether the repeated denials are happening before a successful sign-in, whether the success comes from a new device, and whether there are follow-on actions such as mailbox access, token issuance, or privileged role use. If the denials sit next to those events, treat the account as actively targeted rather than merely noisy.

How to respond without waiting for confirmed compromise

The right response is to act on the pattern, not to wait for proof that the user finally approved a malicious prompt. Disable the active session, force reauthentication, and reset the user’s credentials if the sign-in trail shows suspicious follow-on activity. If the account has elevated rights, treat the incident as higher priority because a single approval can open access to mail, files, admin portals, or downstream systems.

It is also worth checking whether the attacker used the prompt storm as part of a larger identity compromise. Identity Provider and SSO Security Guide covers the adjacent failure modes that often turn MFA fatigue into full account takeover, including token theft, help-desk abuse, and federation weaknesses. That matters because the prompt flood is often just the access pressure stage, not the final breach mechanism.

After containment, tighten the policy that allowed the fatigue path in the first place. Push notifications without number matching, weak recovery workflows, legacy authentication, and permissive MFA prompts all increase the chance that a user will eventually approve something they should not. Where possible, move the account to phishing-resistant methods and raise the bar for step-up authentication on unusual access.

Risk and Threat Considerations

MFA fatigue is effective because it exploits human response under pressure, not a cryptographic flaw. Once an attacker has a valid password or session path, repeated prompts can become a low-cost way to convert partial access into full access, especially when the user is distracted, under time pressure, or confused by multiple alerts.

Failure mechanism: The attacker repeatedly triggers MFA prompts until the user approves one, or until the noise masks a real compromise path such as token theft, mailbox access, or privileged sign-in.

Impact: A single mistaken approval can give the attacker durable access, session establishment, and a path to lateral movement, data theft, or privilege escalation.

Practitioner Guidance

What to verify: Confirm whether the denials cluster around one account, one location, or one short time window, and check whether a later success came from a device or geography the user does not recognise. That distinction tells you whether you are dealing with user annoyance or an active intrusion attempt.

Decision rule: If the denials are paired with an unfamiliar sign-in context, treat the account as compromised-in-progress and contain first, investigate second. If the user reports repeated prompts but there is no abnormal sign-in context, you still need to review policy and prompt volume, because fatigue can be the precursor to a successful approval.

Practitioner takeaway: Repeated MFA denials are not just failed authentication events, they are often the early warning that an attacker is trying to convert user exhaustion into access, so the key is to correlate prompt bursts with sign-in context and respond before approval happens.

Related resources from NHI Mgmt Group

• Guide: MFA Fatigue and Bypass Guide
• How do you detect device registration without MFA in Microsoft Entra ID?
• How do you detect MFA being disabled for user accounts in Microsoft Entra ID?
• What does atypical or impossible travel indicate and how do you detect it in Microsoft Entra ID?
• How do you detect MFA bypass using legacy authentication in Microsoft Entra ID?