How to Improve Passwordless MFA Authentication Security
Question details
Users and administrators need strategies to enhance the security of passwordless Multi-Factor Authentication (MFA) and prevent vulnerabilities like MFA fatigue and accidental approvals.
- Product
- Enterprise Identity Management
- Device & OS
- not provided
- Scenario
- Securing user logins and mitigating fraudulent sign-in approvals in a passwordless environment.
- Observed behavior
- Attackers exploit MFA fatigue by sending repeated fraudulent sign-in prompts, hoping the user accidentally approves one.
Ensure you have administrator access to your organization's identity management portal (such as Microsoft Entra ID or Okta) to configure and enforce authentication policies.
Enable Number Matching and Phishing-Resistant Methods
Prevents accidental approvals by forcing the user to type a specific number displayed on the login screen into their authenticator app.
Relying solely on simple "Approve/Deny" push notifications leaves users vulnerable to MFA fatigue. By implementing number matching, you ensure the user is actively looking at the login screen when approving a request.
For highly privileged accounts, you should transition to fully phishing-resistant methods.
Log into your identity provider's administrator console and navigate to the Security or Authentication Methods section.
Locate the settings for your authenticator app and enable the 'Require number matching for push notifications' policy.
Enforce policies to prefer or require FIDO2 security keys, passkeys, or certificate-based authentication for administrative and highly privileged accounts.
Limit Request Validity and Monitor Sign-in Anomalies
Reduces the window of opportunity for attackers and helps administrators identify compromised accounts quickly.
Secure and Productive Document Management with WPS Office
While managing enterprise identity security is crucial, optimizing your software budget and efficiency is equally important. WPS Office offers a lightweight, highly compatible alternative to Microsoft Office, featuring robust enterprise security controls, seamless document handling, and native support for major Office formats.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded file and follow the on-screen instructions to install WPS Office on your device.
- 3. Sign In Securely: Log in using your enterprise credentials, protected by your organization's established MFA and SSO protocols.
Frequently Asked Questions
What is MFA fatigue or MFA spam?
MFA fatigue occurs when an attacker repeatedly sends push notification approval requests to a user's device, hoping the targeted user will eventually approve it out of annoyance or by accident.
Are biometric logins considered passwordless MFA?
Yes, biometrics like fingerprint or facial recognition are strong, passwordless authentication methods. When combined with a trusted hardware device, they satisfy multi-factor authentication requirements securely.
Does WPS Office support enterprise SSO and MFA?
Yes, WPS Office Enterprise supports integration with major Identity Providers (IdPs) through SSO (Single Sign-On), allowing you to seamlessly enforce your organization's MFA and passwordless authentication policies.
Is two-factor authentication mandatory for attack-surface-reduction rules?
While not strictly mandated by every generic attack-surface-reduction rule, implementing a strong two-factor or multi-factor combination is highly recommended, especially for accounts with privileged access.
