If you have been using the on-premises Azure MFA server (which by the way is going to be fully deprecated – https://azure.microsoft.com/en-us/updates/azure-multifactor-authentication-server-will-be-deprecated-30-september-2024/) you already know that end-users were able to report suspicious activities.
Well, this was a missing feature on Azure AD MFA which is now becoming available.
First, you need to enable it (this is not enabled by default – probably because this is currently in preview).
To enable suspicious activity reporting:
login to your Azure AD portal (https://aad.portal.azure.com/) to access the Azure Active Directory\Security\Authentication methods\Settings blade
or Entra portal (https://entra.microsoft.com/) to access the Protect & secure\Authentication methods\Settings blade
When enabling the report suspicious activities, you can select if this applies to all of your users or a specific group (best practice is to use a group)
Once enabled, you can get the report from:
either the Identity Protection\Risk detections blade; it will appear as User Reported Suspicious Activity for the detection type, with risk level High and source End user reported
or the Active Directory\Sign-in logs blade; it will appear as MFA denied with Fraud Code Entered
This feature works only with Authenticator App prompt or phone call MFA requests.
To report the suspicious activity the user has to use the ‘No, it’s not me ‘button on the Authenticator request
Quick Summary
To enable the Report Suspicious Activity feature, administrators will need to follow the steps mentioned below:
- Sign in to the Azure portal and select Azure Active Directory >> Security >> Authentication Methods >> Settings.
- Enable the Report Suspicious Activity option.
- Select if the new setting applies to all end users or a specific group.
Once enabled, IT admins will be able to view the risk detection report by heading to Azure Active Directory >> Security >> Identity Protection >> Risk detection.
The risk event will appear as detection type “User Reported Suspicious Activity,” with risk level High and source End user reported.
Enjoy!
