This Torq workflow template empowers organizations to proactively detect potential security threats by automating the monitoring of MFA fraud reports within Microsoft Entra ID. It structures a process where, on a regular schedule, the system queries Entra ID audit logs for MFA fraud reports, specifically targeting incidents where users declined MFA requests. The workflow aggregates events by user, creating a comprehensive history of attempts which is then methodically documented in a new and dedicated Torq case. This template is vital for Identity and Access Management, ensuring vigilant oversight and swift response to compromised user credentials or attempted security breaches.
Use Cases
Identity and Access Management
Workflow Breakdown
Set and update a Global Variable for the time checkpoint if one does not already exist.
Pull all audit logs filtered by MFA events.
All events are grouped by user.
Attempts history will be documented in a new Torq case.
Vendors
Utils, HTTP, Microsoft Azure AD, Microsoft 365, Torq, Torq Cases