Fremde Anmeldung in Authenticator App

Question

Hallo,

ich bekomme von der Authenticator App immer wieder ein Anmeldeversuch, obwohl ich keine Anmeldung durchführe.

Ich habe den Verdacht, jemand Fremdes versucht auf meinen Account zu gelangen.

kann man das prüfen ?

Answer 1

It seems that someone is trying to access your account

Make sure 2FA is enabled to provide an additional layer of security to your account.

Answer 2

Hello Butler GmbH,

Thank you for posting your query on Microsoft Q&A.

As per your description, we understand that you are seeing sign-in attempts on your authenticator app.

From Azure, we can prevent a bad actor to successfully sign-in with your user account, but we cannot stop him to attempt to sign-in.

To prevent un-authorized sign-in attempts to reach second factor authentication, we suggest you identify from which IP address the bad user is attempting to sign-in. For that you can check the user sign-ins in azure portal.

Once you get the IP Address of the bad actor, you can configure a Conditional Access Policy to block those Bad IP Addresses.

In Azure portal - Security - Manage - Named Locations, please include all bad IP addresses and give it a name. (Ex : Bad IPs)

While creating CA policy, under Network please exclude the Named Location (Bad Ips) and select block in grant access as shown below.

We strongly recommend using phishing resistant MFA method for all users to prevent unauthorised access.

Reference

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-by-location

And Microsoft recommends following Security Best Practices.

Reference

https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,

Venkata Jagadeep