We’ve been using Microsoft Entra ID’s MFA push notifications for a few months. Lately, I’ve noticed my team just clicks ‘Approve’ without thinking when the prompt pops up on their phones. It’s become a reflex.
Is this “push notification fatigue” a common issue? I’m worried it defeats the security purpose. How are other teams handling this? Are there better MFA methods within Entra ID for this scenario?
Still learning.
Yes, it's absolutely a common issue and a well-documented security weakness. You've correctly identified that the reflex to approve defeats the entire purpose of a second factor. It turns MFA from a verification step into a simple nuisance.
Push notification fatigue is real because the method places the cognitive burden on the user to *deny* a suspicious request, which is backwards. Most legitimate users are just trying to get to their work, so "Approve" is the path of least resistance every single time.
Within Entra ID, you should move to a method that requires positive, conscious action for the legitimate user. Enforce number matching in Authenticator, or better yet, switch to FIDO2 security keys or certificate-based authentication for your team. Those require physical interaction or a specific, non-automatable response. The push notification with number matching at least forces the user to match a number shown on their login screen to their app, breaking the blind-approval habit.
—davidr