Defending the Gates of Microsoft Azure With MFA

This blog post outlines common Azure tenant attack techniques (OSINT user enumeration, OneDrive/OneDrive-user enumeration, password spraying, and MFA bypass via unregistered registration or push-notification fatigue) from an attacker’s perspective and maps those techniques to mitigations: securing security information registration with Conditional Access and trusted IPs, requiring MFA for admins/users, enabling number matching, blocking legacy authentication, and monitoring MFA registration/reporting.