Hunting MFA Fatigue Attacks with KQL

MFA fatigue (a.k.a. MFA bombing) is beautifully low-tech: the attacker already has the password, so they trigger push notification after push notification until a tired user finally taps Approve. No exploit, no malware — just persistence and human nature.

The good news? It leaves a very recognizable footprint in your sign-in logs.

What the pattern looks like

• A burst of MFA challenges for a single user in a short window
• Repeated denied or timeout results
• Then, often, a single success from an unusual location

The detection

Here's a starting-point KQL query for Microsoft Sentinel that flags repeated failed MFA prompts followed by a success:

let lookback = 1h;
let threshold = 5;
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType in ("50074", "500121", "0")   // MFA required / denied / success
| summarize
    denials = countif(ResultType != "0"),
    successes = countif(ResultType == "0"),
    countries = dcount(Location),
    firstSeen = min(TimeGenerated),
    lastSeen = max(TimeGenerated)
  by UserPrincipalName, bin(TimeGenerated, lookback)
| where denials >= threshold and successes >= 1
| project UserPrincipalName, denials, successes, countries, firstSeen, lastSeen
| order by denials desc

Tune before you trust it

Every environment is noisy in its own way. Before you promote this to an alert rule:

• Baseline your normal. Some users genuinely fumble MFA. Look at a week of data first.
• Add allow-lists for known automation or service accounts.
• Enrich with risk. Join to AADUserRiskEvents so a fatigue pattern plus a risky sign-in raises the priority.

Then automate the response

A detection you have to babysit doesn't scale. Wire this into a Sentinel SOAR playbook that, on a confirmed hit, revokes the user's sessions, forces a password reset, and pings the SOC channel. That's how you take MTTR from hours to seconds.

MFA fatigue works because it targets people, not technology. Your defense is to make the pattern loud, catch it early, and respond automatically — before someone taps approve.