MFA fatigue is the attack technique where an adversary repeatedly triggers MFA prompts until a user approves one just to make the notifications stop. In high-profile breaches, this has been the final step — not credential theft, not malware, but a user tapping "Approve" at 11pm because they've received fourteen MFA requests in an hour and want to sleep.
The response is usually to require number matching in the MFA prompt. That's correct. But it addresses only half the problem. The other half is the Conditional Access policy configuration that determines how frequently users are asked to re-authenticate in the first place.
Each Conditional Access policy can specify a session control — how long an authenticated session remains valid before the user must re-authenticate. Problems arise when multiple CA policies apply to the same user with conflicting or cumulative session requirements. A user might hit Policy A (requiring MFA every 4 hours for sensitive applications), Policy B (requiring re-authentication every 1 hour from outside the corporate network), and Policy C (requiring fresh MFA for privileged operations) — resulting in several MFA prompts per working day.
At that frequency, MFA stops feeling like security and starts feeling like interruption. Users begin approving prompts without checking them. The behaviour that makes MFA fatigue attacks successful is taught by the CA policy configuration itself.
The approval trap: When users re-authenticate frequently, they stop reading what they're approving. An MFA notification at 9:15am on a normal working day, three hours after they last authenticated, feels exactly like a legitimate re-authentication request — even if it's an attacker's push. Frequency normalises the prompt. Normalisation removes the scrutiny.
Set explicit sign-in frequency rather than relying on defaults. Differentiate frequency by risk level rather than applying the same policy universally. Use Continuous Access Evaluation where available so session revocation is near-real-time. Require number matching for all MFA methods to eliminate accidental approvals.
For most organisations, a reasonable starting point is a 24-hour persistent session for low-risk access from managed compliant devices, with step-up authentication triggered by risk signals — unfamiliar location, new device, anomalous behaviour — rather than a fixed timer. A user on a managed laptop at their normal location authenticates once at the start of the day. The same user accessing from a new location or unmanaged device is required to re-authenticate, not because of a timer, but because of risk.
Microsoft Authenticator's number matching feature requires the user to enter a number displayed on the sign-in screen into the Authenticator app. This eliminates the simple "Approve" button that makes fatigue attacks effective. Additional context shows what application is requesting authentication and the approximate sign-in location — combined with number matching, this gives users enough information to detect an attack.
M365Clarity checks your Conditional Access configuration for signals relevant to authentication friction and MFA fatigue risk: whether MFA is required via CA policies (not just per-user MFA, which Microsoft is retiring), whether authentication strengths are defined for sensitive access, and whether phishing-resistant methods are included in your authentication policy. The Digital Friction analysis in the Pro plan quantifies configuration choices that drive user workarounds, including CA policies that over-authenticate.
M365Clarity maps your CA policies and shows which users, apps, and access scenarios are protected — and which are exposed.
Run a free scan →Related articles