MFA Fatigue Attacks: The Overlooked Risk Increasing Business Costs

NOTE: As part of our internal f11.ca lab series (EID-EXP-08 ), we simulated a modern MFA fatigue attack, the same technique used in several real-world breaches.Hands-on lab (f11)

For engineers asking how this works technically. 

Technical Deep Understanding 

Most business owners believe:

“We have MFA enabled. We’re secure.”

However, this is no longer accurate.

As part of our internal f11.ca lab series (EID-EXP-08), we simulated a modern MFA fatigue attack, the same technique used in several real-world breaches.

The results highlighted significant risks.

What Is MFA Fatigue?

An attacker obtains an employee’s password.

They repeatedly attempt to log in. 

Your employee’s phone starts buzzing with approval requests:

Approve?

Approve?

Approve?

Eventually, the user clicks “Yes,” either by mistake or out of frustration.

The attacker is now inside your Microsoft 365 environment.

No firewall alert.

No antivirus warning.

Just a simple approval click.

The Business Risk

When an attacker gains access to Microsoft 365, they can:

• Read the executive email.
• Access financial data.
• Launch invoice fraud.
• Deploy ransomware via SharePoint/OneDrive sync.
• Target your customers from your domain.

For SMBs, this can mean:

• Operational downtime
• Reputational damage
• Legal liability
• Compliance violations
• Increased cyber insurance premiums

The average business email compromise incident can cost tens of thousands, not including potential legal and reputational damage. (NetDiligence® Cyber Claims Study 2025 Report, n.d.)

What Our Lab Revealed

In our controlled simulation using:

• Microsoft Entra ID
• Microsoft Entra Identity Protection
• Microsoft Entra Conditional Access

We discovered something critical:

MFA alone does not always prevent fatigue attacks.

Conditional policies are not configured properly:

• Repeated MFA prompts may not trigger automatic blocking.
• No password reset is enforced.
• No risk escalation occurs.

This means your protection relies solely on employees making the correct decision.

This approach is not a security strategy; it is a risk.

The Real Cost of “Basic” Security

Many businesses enable MFA once and assume they are fully protected.

But modern identity security requires:

✔ Risk-based sign-in policies

✔ Automated user risk remediation

✔ Phishing-resistant MFA (number matching or FIDO2)

✔ Continuous monitoring

Without these measures, your Microsoft 365 tenant remains vulnerable to one of the most common attack techniques targeting SMBs today. (MFA Fatigue Attack Targeting Microsoft 365 Users, 2022)

The Impact on Insurance & Compliance

Cyber insurers are increasingly asking:

• Do you enforce risk-based access controls?
• Do you monitor identity risk events?
• Do you block high-risk sign-ins automatically?

Enabling MFA alone may no longer meet underwriting requirements. (Cyber Insurance Requirements Are Changing in 2026 — What SMBs Must Know, 2025)

What Business Owners Should Ask

If you rely on Microsoft 365, ask your IT provider:

1. Are sign-in risk policies enabled?
2. What happens if a user becomes “high risk”?
3. Are password resets enforced automatically?
4. Are legacy authentication methods blocked?
5. Are risky sign-ins reviewed weekly?

If the answer is unclear, your environment may not be as secure as expected.

Final Thought

Cybersecurity is no longer limited to installing tools.

It requires configuring them correctly.

 MFA is a starting point, not the final step.

If you would like a security posture review of your Microsoft 365 environment, we can provide a risk-focused assessment tailored to your business. 

One accidental “Approve” should not be the reason your company faces significant risk.

Need help validating this in your tenant?

This risk exists in most Microsoft 365 tenants.

Identity Security Assessment 

Author: Jaspreet Singh

Platform: MSPInsights.ca

Hands-on Evidence & Labs: f11.ca

References

(n.d.). NetDiligence® Cyber Claims Study 2025 Report. https://rsmus.com/content/dam/rsm/insights/services/risk-fraud-cybersecurity/1pdf/net-diligence-cyber-claims-study-2025-report.inline.pdf

(2022). MFA Fatigue Attack Targeting Microsoft 365 Users. MYDWARE IT Solutions Inc.. https://mydware.com/mfa-fatigue-attack-targeting-microsoft-365-users/

(November 30, 2025). Cyber Insurance Requirements Are Changing in 2026 — What SMBs Must Know. https://www.mis-solutions.com/2025/12/cyber-insurance-requirements-2026/