Eleven denied pushes, then an approval
Count failed MFA push attempts in an Entra sign-in export, find the minute the user gave in, and identify what the attacker already had before the first prompt.
Briefing
priya.s reported that her phone “would not stop buzzing” last night and she tapped approve to make it stop. Error code 500121 means the strong authentication step failed or was denied.
authenticationDetails lists each step of a sign-in. If the password step succeeded every time, the attacker already knew the password.
cloud-shell · Cloud logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.