{
  "id": "CB-M365-AUTH-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-008.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-008",
    "title": "Let all users report suspicious MFA prompts",
    "finding": {
      "title": "Users cannot report MFA prompts they did not request",
      "description": "A user who receives an unexpected MFA prompt can only deny it, so the attempt raises no risk signal and the compromised password stays in use."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "mfa-fatigue",
      "identity-protection",
      "authentication-methods"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "In the Authentication methods policy settings, **Report suspicious activity** is set to\n**Enabled** for **All users**. A user who receives an MFA prompt they did not start can report\nit from Microsoft Authenticator or from the phone call. The report rejects the sign-in, sets the\nuser risk to **High** in ID Protection and writes a **User Reported Suspicious Activity** risk\ndetection.\n\nThe **Microsoft managed** value currently leaves the feature disabled, so it must be set\nexplicitly.\n",
    "rationale": "An unexpected prompt means the attacker already has the password. Turning the user's reaction\ninto a high user risk lets a risk policy force a secure password change or block the account\n(Entra ID P2), and gives the security team a detection to act on with P1.\n",
    "impact": "Users who report by mistake are flagged high risk and may be blocked or asked to change their\npassword by risk policies. Explain the feature to users and to the help desk, and decide who\nreviews the detections.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Settings > Report suspicious activity",
      "default_value": "Microsoft managed (disabled)",
      "recommended_value": "Enabled, All users"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Settings**.\n3. Read **Report suspicious activity** and its target.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicy).ReportSuspiciousActivitySettings | Format-List`\n   (Graph: `GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy`,\n   property `reportSuspiciousActivitySettings`).\n5. Fail if the state is **Disabled** or **Microsoft managed** (`default`), or if the target\n   is not **All users** (`all_users`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Settings**.\n3. Set **Report suspicious activity** to **Enabled** and target **All users**.\n4. Leave **Reporting code** at its default unless custom phone greetings are uploaded.\n5. Select **Save**.\n6. Make sure someone reviews **ID Protection** > **Risk detections**, or that a user risk\n   policy handles high-risk users.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy` with\n`reportSuspiciousActivitySettings` set to `{\"state\": \"enabled\", \"includeTarget\": {\"targetType\": \"group\", \"id\": \"all_users\"}}`.\n",
      "rollback": "Set **Report suspicious activity** back to **Microsoft managed**.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Entra multifactor authentication settings - Report suspicious activity",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-mfa-mfasettings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Protecting authentication methods in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-default-enablement",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1621"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-006",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-030",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}