Authenticator Mfa Fatigue

<# .SYNOPSIS Microsoft Authenticator MFA Fatigue Protection .DESCRIPTION Enables number matching in Microsoft Authenticator to prevent MFA fatigue attacks. Users must enter the number shown on their screen, not just approve. .NOTES Filename: authenticator-mfa-fatigue.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\authenticator-mfa-fatigue.ps1 -Monitoring Check if number matching is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Authenticator MFA Fatigue Protection" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Microsoft Authenticator MFA Fatigue Protection .DESCRIPTION Enables number matching in Microsoft Authenticator to prevent MFA fatigue attacks. Users must enter the number shown on their screen, not just approve. .NOTES Filename: authenticator-mfa-fatigue.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\authenticator-mfa-fatigue.ps1 -Monitoring Check if number matching is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Authenticator MFA Fatigue Protection" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Authenticator configuration..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $authenticatorPolicy = $authMethods.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' } $result = @{ isCompliant = $false numberMatchingEnabled = $false locationEnabled = $false } if ($authenticatorPolicy) { $featureSettings = $authenticatorPolicy.featureSettings # Check number matching if ($featureSettings.numberMatchingRequiredState.state -eq 'enabled') { Write-Host " [OK] Number Matching: ENABLED (Prevents MFA fatigue)" -ForegroundColor Green $result.numberMatchingEnabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] Number Matching: DISABLED (Vulnerable to MFA fatigue!)" -ForegroundColor Red } # Check additional context if ($featureSettings.displayLocationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Location Context: ENABLED" -ForegroundColor Green $result.locationEnabled = $true } else { Write-Host " ⚠️ Location Context: DISABLED" -ForegroundColor Yellow } # Check application context if ($featureSettings.displayApplicationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Application Context: ENABLED" -ForegroundColor Green } } else { Write-Host " [FAIL] Microsoft Authenticator not configured" -ForegroundColor Red } Write-Host "`nWhat is MFA Fatigue?" -ForegroundColor Cyan Write-Host " Attackers spam MFA requests hoping user approves by mistake" -ForegroundColor Gray Write-Host " Number matching forces user to enter a number = prevents fatigue" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable number matching!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Configure in: Azure AD > Security > Authentication methods > Microsoft Authenticator" -ForegroundColor Yellow exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Enabling number matching via API..." -ForegroundColor Yellow Write-Host "Note: This requires Azure AD Premium" -ForegroundColor Cyan Write-Host "`nRecommended manual steps:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure AD > Security" -ForegroundColor Gray Write-Host " 2. Authentication methods > Microsoft Authenticator" -ForegroundColor Gray Write-Host " 3. Enable 'Require number matching' for all users" -ForegroundColor Gray Write-Host " 4. Enable 'Show application name' (additional context)" -ForegroundColor Gray Write-Host " 5. Enable 'Show geographic location' (additional context)" -ForegroundColor Gray Write-Host " 6. Save configuration" -ForegroundColor Gray Write-Host "`n📝 Impact:" -ForegroundColor Cyan Write-Host " • Users see a number on sign-in screen" -ForegroundColor Gray Write-Host " • Must enter that number in Authenticator app" -ForegroundColor Gray Write-Host " • Prevents accidental/fatigued approvals" -ForegroundColor Gray Write-Host " • Significantly reduces MFA fatigue attacks" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Authenticator configuration..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $authenticatorPolicy = $authMethods.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' } $result = @{ isCompliant = $false numberMatchingEnabled = $false locationEnabled = $false } if ($authenticatorPolicy) { $featureSettings = $authenticatorPolicy.featureSettings # Check number matching if ($featureSettings.numberMatchingRequiredState.state -eq 'enabled') { Write-Host " [OK] Number Matching: ENABLED (Prevents MFA fatigue)" -ForegroundColor Green $result.numberMatchingEnabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] Number Matching: DISABLED (Vulnerable to MFA fatigue!)" -ForegroundColor Red } # Check additional context if ($featureSettings.displayLocationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Location Context: ENABLED" -ForegroundColor Green $result.locationEnabled = $true } else { Write-Host " ⚠️ Location Context: DISABLED" -ForegroundColor Yellow } # Check application context if ($featureSettings.displayApplicationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Application Context: ENABLED" -ForegroundColor Green } } else { Write-Host " [FAIL] Microsoft Authenticator not configured" -ForegroundColor Red } Write-Host "`nWhat is MFA Fatigue?" -ForegroundColor Cyan Write-Host " Attackers spam MFA requests hoping user approves by mistake" -ForegroundColor Gray Write-Host " Number matching forces user to enter a number = prevents fatigue" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable number matching!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Configure in: Azure AD > Security > Authentication methods > Microsoft Authenticator" -ForegroundColor Yellow exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Microsoft Authenticator MFA Fatigue Protection .DESCRIPTION Enables number matching in Microsoft Authenticator to prevent MFA fatigue attacks. Users must enter the number shown on their screen, not just approve. .NOTES Filename: authenticator-mfa-fatigue.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\authenticator-mfa-fatigue.ps1 -Monitoring Check if number matching is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Authenticator MFA Fatigue Protection" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Authenticator configuration..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $authenticatorPolicy = $authMethods.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' } $result = @{ isCompliant = $false numberMatchingEnabled = $false locationEnabled = $false } if ($authenticatorPolicy) { $featureSettings = $authenticatorPolicy.featureSettings # Check number matching if ($featureSettings.numberMatchingRequiredState.state -eq 'enabled') { Write-Host " [OK] Number Matching: ENABLED (Prevents MFA fatigue)" -ForegroundColor Green $result.numberMatchingEnabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] Number Matching: DISABLED (Vulnerable to MFA fatigue!)" -ForegroundColor Red } # Check additional context if ($featureSettings.displayLocationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Location Context: ENABLED" -ForegroundColor Green $result.locationEnabled = $true } else { Write-Host " ⚠️ Location Context: DISABLED" -ForegroundColor Yellow } # Check application context if ($featureSettings.displayApplicationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Application Context: ENABLED" -ForegroundColor Green } } else { Write-Host " [FAIL] Microsoft Authenticator not configured" -ForegroundColor Red } Write-Host "`nWhat is MFA Fatigue?" -ForegroundColor Cyan Write-Host " Attackers spam MFA requests hoping user approves by mistake" -ForegroundColor Gray Write-Host " Number matching forces user to enter a number = prevents fatigue" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable number matching!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Configure in: Azure AD > Security > Authentication methods > Microsoft Authenticator" -ForegroundColor Yellow exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Enabling number matching via API..." -ForegroundColor Yellow Write-Host "Note: This requires Azure AD Premium" -ForegroundColor Cyan Write-Host "`nRecommended manual steps:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure AD > Security" -ForegroundColor Gray Write-Host " 2. Authentication methods > Microsoft Authenticator" -ForegroundColor Gray Write-Host " 3. Enable 'Require number matching' for all users" -ForegroundColor Gray Write-Host " 4. Enable 'Show application name' (additional context)" -ForegroundColor Gray Write-Host " 5. Enable 'Show geographic location' (additional context)" -ForegroundColor Gray Write-Host " 6. Save configuration" -ForegroundColor Gray Write-Host "`n📝 Impact:" -ForegroundColor Cyan Write-Host " • Users see a number on sign-in screen" -ForegroundColor Gray Write-Host " • Must enter that number in Authenticator app" -ForegroundColor Gray Write-Host " • Prevents accidental/fatigued approvals" -ForegroundColor Gray Write-Host " • Significantly reduces MFA fatigue attacks" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Enabling number matching via API..." -ForegroundColor Yellow Write-Host "Note: This requires Azure AD Premium" -ForegroundColor Cyan Write-Host "`nRecommended manual steps:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure AD > Security" -ForegroundColor Gray Write-Host " 2. Authentication methods > Microsoft Authenticator" -ForegroundColor Gray Write-Host " 3. Enable 'Require number matching' for all users" -ForegroundColor Gray Write-Host " 4. Enable 'Show application name' (additional context)" -ForegroundColor Gray Write-Host " 5. Enable 'Show geographic location' (additional context)" -ForegroundColor Gray Write-Host " 6. Save configuration" -ForegroundColor Gray Write-Host "`n📝 Impact:" -ForegroundColor Cyan Write-Host " • Users see a number on sign-in screen" -ForegroundColor Gray Write-Host " • Must enter that number in Authenticator app" -ForegroundColor Gray Write-Host " • Prevents accidental/fatigued approvals" -ForegroundColor Gray Write-Host " • Significantly reduces MFA fatigue attacks" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Microsoft Authenticator MFA Fatigue Protection .DESCRIPTION Enables number matching in Microsoft Authenticator to prevent MFA fatigue attacks. Users must enter the number shown on their screen, not just approve. .NOTES Filename: authenticator-mfa-fatigue.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\authenticator-mfa-fatigue.ps1 -Monitoring Check if number matching is enabled #> #Requires -Version 5.1 #Requires -Modules Microsoft.Graph [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Authenticator MFA Fatigue Protection" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome Write-Host "Checking Authenticator configuration..." -ForegroundColor Gray $authMethods = Invoke-MgGraphRequest -Method GET ` -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" $authenticatorPolicy = $authMethods.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' } $result = @{ isCompliant = $false numberMatchingEnabled = $false locationEnabled = $false } if ($authenticatorPolicy) { $featureSettings = $authenticatorPolicy.featureSettings # Check number matching if ($featureSettings.numberMatchingRequiredState.state -eq 'enabled') { Write-Host " [OK] Number Matching: ENABLED (Prevents MFA fatigue)" -ForegroundColor Green $result.numberMatchingEnabled = $true $result.isCompliant = $true } else { Write-Host " [FAIL] Number Matching: DISABLED (Vulnerable to MFA fatigue!)" -ForegroundColor Red } # Check additional context if ($featureSettings.displayLocationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Location Context: ENABLED" -ForegroundColor Green $result.locationEnabled = $true } else { Write-Host " ⚠️ Location Context: DISABLED" -ForegroundColor Yellow } # Check application context if ($featureSettings.displayApplicationInformationRequiredState.state -eq 'enabled') { Write-Host " [OK] Application Context: ENABLED" -ForegroundColor Green } } else { Write-Host " [FAIL] Microsoft Authenticator not configured" -ForegroundColor Red } Write-Host "`nWhat is MFA Fatigue?" -ForegroundColor Cyan Write-Host " Attackers spam MFA requests hoping user approves by mistake" -ForegroundColor Gray Write-Host " Number matching forces user to enter a number = prevents fatigue" -ForegroundColor Gray if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Enable number matching!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red Write-Host "Configure in: Azure AD > Security > Authentication methods > Microsoft Authenticator" -ForegroundColor Yellow exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Enabling number matching via API..." -ForegroundColor Yellow Write-Host "Note: This requires Azure AD Premium" -ForegroundColor Cyan Write-Host "`nRecommended manual steps:" -ForegroundColor Cyan Write-Host " 1. Azure Portal > Azure AD > Security" -ForegroundColor Gray Write-Host " 2. Authentication methods > Microsoft Authenticator" -ForegroundColor Gray Write-Host " 3. Enable 'Require number matching' for all users" -ForegroundColor Gray Write-Host " 4. Enable 'Show application name' (additional context)" -ForegroundColor Gray Write-Host " 5. Enable 'Show geographic location' (additional context)" -ForegroundColor Gray Write-Host " 6. Save configuration" -ForegroundColor Gray Write-Host "`n📝 Impact:" -ForegroundColor Cyan Write-Host " • Users see a number on sign-in screen" -ForegroundColor Gray Write-Host " • Must enter that number in Authenticator app" -ForegroundColor Gray Write-Host " • Prevents accidental/fatigued approvals" -ForegroundColor Gray Write-Host " • Significantly reduces MFA fatigue attacks" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }