Even the best security tools can be undone by human behavior. Multi-factor authentication (MFA) remains one of the most effective defenses against account compromise. However, attackers have found a new way to turn it against users through persistence, pressure, and fatigue.
What MFA Fatigue Looks Like
Multi-factor authentication (MFA) has long been the gold standard for account protection. Requiring something more than a password, like a push notification on a phone, adds a critical layer of defense. But recently, that very safeguard has become a new attack vector.
MFA fatigue, also known as push-bombing, happens when a cybercriminal repeatedly sends MFA prompts to a user’s device after stealing their username and password. The constant flood of requests wears the user down until they finally approve one out of annoyance or distraction.
Microsoft reports roughly 6,000 MFA fatigue attempts per day across its cloud ecosystem. While MFA can reduce the risk of account compromise by 99.2%, attackers have learned that human behavior is the easiest layer to exploit.
A recent Verizon Data Breach Investigations Report (DBIR) highlighted that 68% of breaches involve the human element. For small and midsize businesses (SMBs), that reality hits harder. With limited security staffing and constant notifications from Microsoft 365, legitimate users can easily mistake a real prompt for noise. According to Microsoft, about 1% of users automatically approve the first MFA push they see. That tiny percentage is all attackers need.
When a single employee gives in to fatigue, the attacker gains full access, often to Microsoft 365 environments rich with sensitive data and admin privileges.
Quick Wins: Number Matching and Awareness
Here’s the good news: the easiest fix for MFA fatigue is already available in Microsoft 365. It’s called number matching, one of the simplest ways to shut down push-bombing.
Instead of just approving a vague “sign-in attempt,” users must type a code shown on the login screen into their authenticator app. That small step breaks the attacker’s playbook. Even if the user gets bombarded with prompts, they can’t guess the number without seeing the login screen, which only the legitimate user can access.
Microsoft began enforcing number matching across all tenants in 2023, but many organizations haven’t enabled or verified it. If your MFA setup still uses simple “Approve/Deny” prompts, your defenses are a year behind the curve.
Beyond configuration, user awareness plays a huge role. Employees should understand that any unexpected MFA prompt is a red flag, not a routine annoyance. Encourage them to deny unknown requests and immediately alert IT. A short internal campaign or coaching session can drastically improve Microsoft 365 identity security.
When MFA fatigue attacks SMB teams, it’s about human reflexes under pressure. Training and number matching help rewire that reflex.
Stronger Controls: FIDO2 and Conditional Access
Once you’ve handled the quick wins, it’s time to strengthen identity protection further. The next evolution of MFA security lies in phishing-resistant authentication methods like FIDO2 keys.
FIDO2 eliminates passwords, using physical security keys or built-in device authenticators. Because authentication happens locally on the device, attackers can’t trick users into approving anything: no push notifications, no fatigue, no chance of human error.
Pairing that with conditional access policies creates a modern zero-trust environment. Before granting access, these policies evaluate user behavior and context, such as location, device compliance, or risk level. For instance, a sign-in attempt from another country or an unmanaged device can automatically trigger additional verification or be blocked outright.
These capabilities aren’t just for large enterprises anymore. With Azure AD Premium and Microsoft 365 Business Premium, SMBs can apply the same sophisticated identity rules as Fortune 500 companies.
Organizations should integrate these features into a comprehensive identity and access management strategy to make the most of them. This ensures consistency across users, devices, and applications.
Behind the scenes, advanced managed security (MDR/SOC) services can continuously monitor login patterns, detect MFA abuse attempts, and respond in real time. Attackers don’t work business hours, and neither should your defenses.
Why GDS
Global Data Systems (GDS) has guided hundreds of organizations through MFA modernization and Microsoft 365 hardening. Our approach focuses on simplifying security for real users because complexity is often the enemy of compliance.
We help SMBs deploy number matching and FIDO2, configure conditional access policies, and implement continuous monitoring through our Managed Security operations. But more importantly, we coach teams to recognize and react to MFA fatigue in the moment.
Our experts combine identity analytics, automation, and proactive threat hunting to reduce fatigue-driven compromises before they happen. For SMB IT leaders, that means fewer false alarms, more confident users, and measurable risk reduction across your Microsoft 365 identity security landscape.
Think of it as building resilience through more innovative design. The goal is to create a security culture where users and systems reinforce each other.
Start an Automation Pilot
The truth about MFA fatigue is simple: it’s not going away. As long as users receive prompts, attackers will try to exploit them. But with the right mix of technology and awareness, fatigue doesn’t have to be your weak point.
GDS helps organizations launch automation pilots that remove human error from the authentication process and streamline security operations. From deploying FIDO2 to refining conditional access policies, we help your Microsoft 365 identity security evolve beyond the “approve or deny” era.
If you’re ready to strengthen your defenses against MFA fatigue and reduce alert overload across your team, it’s time to contact GDS. Together, we’ll turn MFA from a point of failure into a foundation of trust.