EIDSCA.AG02: Authentication Method - General Settings - Report suspicious activity - State.

ID	EIDSCA.AG02
Severity	Medium
Suite	EIDSCA
Product	Entra ID
Feature	Authentication methods
Security area	Authentication
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:SI-4(5) System Monitoring | System-generated Alerts
MITRE ATT&CK	T1621, T1078.004
Reads from	Microsoft Graph

What this checks and how to fix it

Allows users to report suspicious activities if they receive an authentication request that they did not initiate. This control is available when using the Microsoft Authenticator app and voice calls. Reporting suspicious activity will set the user’s risk to high. If the user is subject to risk-based Conditional Access policies, they may be blocked.

Allows to integrate report of fraud attempt by users to identity protection: Users who report an MFA prompt as suspicious are set to High User Risk. Administrators can use risk-based policies to limit access for these users, or enable self-service password reset (SSPR) for users to remediate problems on their own.

Test script

https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy
.reportSuspiciousActivitySettings.state -eq 'enabled'

Remediation action

Microsoft Learn - Report suspicious activites

Related links

• Open in Graph Explorer
• Get authenticationMethodsPolicy - Microsoft Graph v1.0 | Microsoft Learn
• View in Microsoft Entra admin center

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.