Let all users report suspicious MFA prompts

Description

In the Authentication methods policy settings, Report suspicious activity is set to Enabled for All users. A user who receives an MFA prompt they did not start can report it from Microsoft Authenticator or from the phone call. The report rejects the sign-in, sets the user risk to High in ID Protection and writes a User Reported Suspicious Activity risk detection.

The Microsoft managed value currently leaves the feature disabled, so it must be set explicitly.

Rationale

An unexpected prompt means the attacker already has the password. Turning the user's reaction into a high user risk lets a risk policy force a secure password change or block the account (Entra ID P2), and gives the security team a detection to act on with P1.

Impact

Users who report by mistake are flagged high risk and may be blocked or asked to change their password by risk policies. Explain the feature to users and to the help desk, and decide who reviews the detections.

Applies when

Requires: Microsoft Entra ID P1

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Settings.
3. Read Report suspicious activity and its target.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): (Get-MgPolicyAuthenticationMethodPolicy).ReportSuspiciousActivitySettings | Format-List (Graph: GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy, property reportSuspiciousActivitySettings).
5. Fail if the state is Disabled or Microsoft managed (default), or if the target is not All users (all_users).

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Settings.
3. Set Report suspicious activity to Enabled and target All users.
4. Leave Reporting code at its default unless custom phone greetings are uploaded.
5. Select Save.
6. Make sure someone reviews ID Protection > Risk detections, or that a user risk policy handles high-risk users. Graph equivalent: PATCH /policies/authenticationMethodsPolicy with reportSuspiciousActivitySettings set to {"state": "enabled", "includeTarget": {"targetType": "group", "id": "all_users"}}.

Rollback

Set Report suspicious activity back to Microsoft managed.

References

• Configure Microsoft Entra multifactor authentication settings - Report suspicious activity Microsoft, vendor-doc, accessed 2026-10-24
• Protecting authentication methods in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-006 Show application name and location in Microsoft Authenticator notifications
• related CB-M365-AUTH-030 Block or force secure remediation for users at high risk

People and lifecycle