I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations.
How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet to find any articles stating this. Most I see is how TXT based is no good.
Example with the Approve/Deny type of MFA: If a threat actor types in your credentials - your phone will get an Approve or Deny request. One of our end-users today got a fake "Check your VM" spam message - she clicked on this message, it took her to a fake O365 Login page, she typed in her creds, a few seconds later she got an Approve or Deny request - she Approved thinking she was logging into O365- 2 minutes later we got a notification that the same user tried to log in from Russia -- immediately disabled and revoked all sessions.
Can someone explain to me how this MFA approval method is OK? this would never work with TXT or authenticator code sign on. (you need to input the proper codes into the site to proceed to log on) Not to mention that the average user will just click 'approve' randomly thinking their Phone, tablet, or PC needs to approve again.
What am I missing here?