I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations.

How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet to find any articles stating this. Most I see is how TXT based is no good.

Example with the Approve/Deny type of MFA: If a threat actor types in your credentials - your phone will get an Approve or Deny request. One of our end-users today got a fake "Check your VM" spam message - she clicked on this message, it took her to a fake O365 Login page, she typed in her creds, a few seconds later she got an Approve or Deny request - she Approved thinking she was logging into O365- 2 minutes later we got a notification that the same user tried to log in from Russia -- immediately disabled and revoked all sessions.

Can someone explain to me how this MFA approval method is OK? this would never work with TXT or authenticator code sign on. (you need to input the proper codes into the site to proceed to log on) Not to mention that the average user will just click 'approve' randomly thinking their Phone, tablet, or PC needs to approve again.

What am I missing here?


It would probably have worked with an authenticator code as well: your end-user enters the code in the fake login page which enters it in the real login page right after and gains access.

However, MFA will prevent anyone possessing only your login/password to authenticate (you need both factors at hand).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.