Microsoft Graph MFA Method Configuration Modification

nomit vyas@xoxo

•updated Jun 25, 2026•2•0•21

Detects network requests to Microsoft Graph API that appear to be modifying authentication methods, specifically targeting phone-based multi-factor authentication settings. This may indicate an adversary attempting to register their own MFA device to a compromised account to maintain persistence or bypass MFA.