Multi-Factor Authentication Request Generation

Adversaries may abuse identity-provider authentication or configured self-service password-reset flows to generate MFA requests sent to users. With valid account credentials, repeated interactive sign-in attempts can bombard a user with push notifications in an MFA-fatigue attempt; some providers can also generate prompts through configured SSPR when the adversary lacks the account password. A request is generated only when provider policy and the account's enrolled authentication methods require it.