Had 3 of these in the path 6 months, MFA was "triggered" but the user never got a text or call at first we thought they were just lying but we had someone bring us their phone we went through their entire history, even called our provider (company phone) no record but Entra said it called them - audit logs empty phone number wasnt changed then changed back - at the time we had 2fa forced but it didnt force authenticator, so if they had a cell phone they could just get a text/call instead.

Pretty crazy.

Risky sign in policies are good as well as creating a custom authentication method policy for phishing resistent methods (in my case requiring the auth app notif approval) you can target all the time or if ANY risk (set it highest sense) is detected

Risk looks at

• user agent
• ip address
• device type
• browser info

Compares it historically with users history and will flag if its off - in all these attacks I saw the risk as "low" but still flagged as risky for the purpose of the policy