MFA Fatigue and MFA Reset Attacks: A Help Desk Playbook

How push bombing works, why attackers moved on to asking the help desk for MFA resets, and how to verify, reset safely in Microsoft Entra and alert.

MFA fatigue is flooding a user with sign-in prompts until they approve one. Number matching has mostly closed that route in Microsoft Entra, so attackers now call the help desk and ask for an MFA reset instead. Treat every reset as a privileged action: verify the caller, reset with a one-time Temporary Access Pass, and alert on resets to admin accounts.

This page is part of the help desk social engineering series. It covers phase 5 of the PAM journey, enforcing MFA and secure access, and where it hands off to just-in-time access in phase 6.

What an MFA Fatigue Attack Is

The attacker already has the password. They sign in again and again, and each attempt sends a push notification to the real user's phone, until the user taps approve to make it stop or by mistake. MITRE ATT&CK tracks this as Multi-Factor Authentication Request Generation, and lists Scattered Spider, LAPSUS$ and APT29 among the groups that use it.

Two public cases show how little it takes:

• Uber, September 2022. Uber's own account: the attacker likely bought a contractor's password on the dark web, and the contractor received repeated two-factor approval requests that "initially blocked access. Eventually, however, the contractor accepted one."
• Cisco, August 2022. Cisco Talos reported that the attacker combined voice phishing, calling over several days while posing as trusted organisations, with a high volume of push requests until the employee accepted one and the attacker reached the VPN.

Why Push Bombing Is Harder Now, and Why Attackers Moved to the Help Desk

Number matching breaks the simple version of the attack: the user has to type a number shown on the sign-in screen, which a person being bombed from somewhere else can't see. Microsoft's documentation says number matching is enabled for all Microsoft Authenticator push notifications and users can't opt out.

CISA published guidance in October 2022 recommending number matching as an interim step where phishing-resistant MFA isn't possible yet. Phishing-resistant MFA (FIDO2 security keys, passkeys, certificate-based authentication) is the end state, because there's no code or approval to talk someone out of.

So the pressure moved. If the prompt can't be forced, the attacker asks the help desk to remove the user's MFA and let them enrol a new device:

• Okta reported on 31 August 2023 that several US customers saw "a consistent pattern of social engineering attacks against their IT service desk personnel", with callers trying to get service desks "to reset all Multi-factor Authentication (MFA) factors enrolled by highly privileged users."
• CISA's Scattered Spider advisory (November 2023) describes the group posing as IT and help desk staff, SIM swapping, and sending "repeated MFA notification prompts" until employees accepted.
• In July 2025, Microsoft reported that the same group, which it tracks as Octo Tempest, was still getting in by "impersonating a user and contacting service desk support through phone calls, emails, and messages."

What an MFA Reset Does in Microsoft Entra

A reset removes the user's second factor and lets whoever signs in next register a new one. If the caller was the attacker, the next person to sign in is the attacker.

Microsoft's documentation for managing a user's authentication methods spells out the admin actions:

• Require re-register MFA deactivates the user's hardware OATH tokens and deletes their phone numbers, Microsoft Authenticator apps and software OATH tokens.
• Revoke sessions invalidates the user's refresh tokens and forces reauthentication across active sessions and apps.
• Reset password sets a temporary password the user must change at next sign-in.

Reset the password and require MFA re-registration on the same call, and you have handed over the whole account. That's the combination the attacker is asking for.

Why MSP Help Desks Carry More of This Risk

One MSP service desk answers for users at dozens of clients. Technicians rarely know who is calling, and a technician often holds reset rights in many client tenants at once. A weak reset process at the MSP is a weak reset process at every client.

Entra gives you a boundary to use. An Authentication Administrator can manage authentication methods and issue Temporary Access Passes for regular users, but not for most admin roles. Doing either for an admin takes a Privileged Authentication Administrator. Give most technicians the first role, and grant the second only when a specific admin reset needs it, with approval.

How to Reset MFA Safely in Entra

Verify first, then reset in a way that leaves nothing reusable behind. For a user who really has lost their device:

1. Open a ticket before acting, even for a quick reset. It creates the record and slows the urgency play.
2. Verify the caller by possession or presence, never by knowledge questions. If the user still has their authenticator, push a verification to it. If they don't, call back a number already on file, or verify through their manager using contact details you already hold. Never use a number the caller gives you. The help desk caller verification procedure covers verification step by step.
3. Require re-register MFA on the user in Microsoft Entra, and revoke sessions so any token the attacker may already hold stops working.
4. Issue a Temporary Access Pass (TAP) instead of reading out a password. A TAP is a time-limited passcode the user signs in with to register a new method. Tenant policy sets its lifetime (10 minutes to 30 days; the default is 1 hour) and can force one-time use. Keep it short and one-time for recoveries.
5. Send admin and executive resets to a second technician for approval, and have that person hold the Privileged Authentication Administrator role only for the task.
6. Record how you verified on the ticket: who asked, the method, which technician acted, in which tenant.

What to Do When a User Reports Prompts They Didn't Start

Treat it as a compromised password, not a nuisance. The prompts mean someone has the password and is trying to get past MFA.

1. Reset the password and revoke sessions.
2. Check the user's sign-in logs for the source of the attempts and for any sign-in that succeeded.
3. Check whether any new authentication method was registered on the account, and remove it if it wasn't the user.
4. If the account has admin rights anywhere, treat it as an incident across every tenant it can reach.

Where This Sits in the PAM Journey

MFA protects the sign-in. Just-in-time access limits what the sign-in is worth. You need both, because verification will fail eventually.

• Phase 5, enforce MFA and secure access: number matching on for everyone, phishing-resistant methods on every admin account, and no SMS or voice fallback for admins. Help desk verification before a reset belongs here too, because a reset is the easiest way around MFA.
• Phase 6, just-in-time access and zero standing privilege: technician admin accounts stay disabled until a task needs them. An attacker who gets through a reset on an everyday account finds no admin rights on it.
• Phase 7, audit, monitor and alert: an alert whenever an admin account's MFA is reset or a new method is registered. On Okta, the company's own guidance is to alert on the user.mfa.factor.reset_all system log event.

How CyberQP Handles It

CyberQP's QDesk verifies end users who contact the help desk before a password or MFA reset. The technician sends the request from the ticket or while on the phone, and the user either approves it in the CyberQP mobile app, Microsoft Authenticator or Duo, or reads back a code sent to them by SMS or email. Help desk identity verification is coming to Panthera; it isn't in Panthera yet. In Panthera today, technicians can work from dedicated just-in-time accounts that are disabled by default, can require a second approval and can be tied to a ConnectWise Manage ticket, and changes to privileged accounts show up in Panthera's event log and auditing alerts.

What Done Looks Like

• Number matching is on in every client tenant, and admin accounts use phishing-resistant MFA with no SMS fallback.
• Every MFA reset, across every client, is verified by possession or presence, and the method is recorded on the ticket.
• Recoveries use short, one-time Temporary Access Passes, never passwords read aloud.
• Admin resets need a second person and a role that is granted only for the task.
• You get an alert when an admin account's MFA changes.

Frequently Asked Questions

What is an MFA fatigue attack?

An attacker with a stolen password sends repeated MFA push prompts to the real user until they approve one. It's also called MFA bombing or push bombing, and MITRE ATT&CK tracks it as Multi-Factor Authentication Request Generation.

Does number matching stop MFA fatigue?

It stops the simple version, because the user has to type a number they can only see on the sign-in screen. It doesn't stop an attacker who calls the user and talks them through it, or one who gets the help desk to reset MFA instead. Phishing-resistant MFA is the stronger fix.

How do I reset a user's MFA in Microsoft Entra?

In Microsoft Entra, open the user's authentication methods and choose Require re-register MFA, then revoke their sessions. Issue a short, one-time Temporary Access Pass so they can register a new method. You need at least the Authentication Administrator role, and Privileged Authentication Administrator for most admin accounts.

Should the help desk ever reset MFA over the phone?

Only after verifying the caller by something they have or can show, through a channel you start. Knowledge questions don't count: attackers research the answers before calling.

Is SMS acceptable as a second factor for admins?

No. SIM swapping is a documented Scattered Spider technique in CISA's advisory. Keep SMS and voice off admin accounts, and use FIDO2 keys, passkeys or certificate-based authentication.

Sources: MITRE ATT&CK, Multi-Factor Authentication Request Generation (T1621), last modified 24 Oct 2025; Uber security update (16 Sep 2022, updated 19 Sep 2022); Cisco Talos (10 Aug 2022); Microsoft Learn, number matching; CISA phishing-resistant and number matching MFA guidance (31 Oct 2022); Okta, cross-tenant impersonation (31 Aug 2023); CISA AA23-320A, Scattered Spider (16 Nov 2023); Microsoft, Protecting customers from Octo Tempest attacks across multiple industries (16 Jul 2025); Microsoft Learn, manage user authentication methods; Microsoft Learn, Temporary Access Pass; Microsoft Learn, privileged roles and permissions.

Related: help desk social engineering: how the attack works, help desk caller verification: a nine-step procedure, zero standing privilege and the PAM journey, QDesk help desk identity verification, start a free trial, book a demo.