Azure AD MFA Fraud alert is explicitly documented in the SC-300 content as the control to combat push- bombing. The documentation explains: "Enable Fraud alert so users can report unexpected MFA prompts; when configured to block the user , Azure AD marks the user as blocked automatically upon the fraud report.
" It also notes: "The block remains in effect (default 90 days) until an administrator unblocks the user." This directly satisfies the requirement to automatically block users when they report that they did not initiate the sign-in. Other MFA configurations-such as account lockout thresholds-address repeated denial scenarios and rate-limiting but do not trigger an immediate block as a result of a user's fraud report. Configuring Fraud alert therefore meets the goal exactly, aligning with SC-300's best-practice guidance for protecting users from unsolicited MFA prompts.