What this check looks at
Checks that people can report an MFA prompt they did not start, for all users, so an attacker who has their password is caught at the prompt rather than let in by a tired tap.
MFA fatigue is how many accounts are now taken over: an attacker who already has someone’s password signs in again and again, and each attempt sends an MFA prompt to the person’s phone. Most people decline the first few. Sooner or later a tired or confused person approves one, and the attacker is in.
Report suspicious activity lets the person do more than decline: when a prompt arrives that they did not start, they tap “No, it’s not me” and report it. Entra ID then marks their account as high risk, which a user risk policy can act on at once, and the report shows in the sign-in and risk logs for the IT team.
The check fails when Report suspicious activity is off, or left to Microsoft’s default, which is off. It is partly met when it is on for some groups only, and passes when it is on for all users. A tenant whose setting was not returned is not checked.
Why it matters
An attacker with someone’s password sends MFA prompts until one is approved. With reporting on, the person taps “No, it’s not me” and reports it: their account is marked high risk, so Identity Protection policies can block it and the IT team sees it at once. Without it, a declined prompt leaves no trace anyone acts on.
A declined prompt on its own tells nobody anything: the attacker simply tries again later, and the password they hold stays valid. A reported prompt is a signal the business can act on within minutes, by blocking the account or forcing a password change, before a later prompt is approved.
It costs nothing, needs no licence beyond what MFA already uses, and changes nothing for people who never receive a prompt they did not start. Microsoft recommends turning it on for everyone, and it works best beside a user risk policy that blocks high-risk users or makes them change their password.
The rule maps to NIST CSF 2.0 DE.CM-03, monitoring personnel activity to find adverse events, and to ISO 27001 A.5.25, assessment of information security events.
How to fix it
Where: Entra admin centre → Protection → Authentication methods → Settings
Before you start
- Check a user risk policy acts on high-risk users, so a report blocks the account or forces a password change rather than only being recorded.
Step by step
- Open the authentication method settings. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > Settings and find Report suspicious activity.
- Turn it on for all users. Set State to Enabled and the target to All users, then select Save.
- Make a report count. Check that a user risk policy (Conditional Access, or Identity Protection’s own) blocks high-risk users or requires a secure password change, so a reported account is protected at once rather than only recorded.
- Tell people what it is for. A short note to staff: an MFA prompt you did not start is never yours to approve; deny it and choose Report. The service desk will see the report and reset the password.
- Confirm. Reopen Settings and check Report suspicious activity shows Enabled for All users. Re-run the assessment to confirm.
What users will notice
People see a “Report” option when they decline a prompt they did not start. Reporting marks their account high risk until it is reviewed.
How to confirm it worked
Entra admin centre, Authentication methods, Settings: Report suspicious activity is Enabled for All users.
Frameworks and controls
This check maps to controls in 9 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisationC1.a Monitoring coverage |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| ISO 27001:2022 | A.8.5 Secure authenticationA.5.25 Assessment and decision on information security events |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events |
| NCSC 10 Steps | Identity and access managementLogging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Report suspicious activity (Microsoft Learn)