Created by Claude - please verify

MFA fatigue - based on sign-in error 500121 and its failure text; wording of failure reasons can change.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1.

Endpoint: GET /beta/auditLogs/signIns (7 days)

Listed: users with at least 3 failed MFA attempts, or any denied/reported prompt. Number matching and 'report suspicious activity' (see the Auth Methods Policy report) blunt this attack.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

MFA Fatigue & Repeated MFA Denials

An attacker with a user's password sends MFA prompt after prompt until the user taps Approve. Users who denied or reported prompts, or saw many failed MFA attempts - especially followed by a successful sign-in - may be under attack right now.

No user had repeated or denied MFA prompts in the last 7 days.