The scenario describes users receiving unexpected MFA prompts - a clear indication of a potential MFA fatigue attack (attackers repeatedly send MFA requests hoping users approve one).
To mitigate this, Microsoft documentation recommends enabling automatic blocking of users when they report fraudulent MFA requests.
This can be configured in the Azure portal # Azure AD # Security # MFA # Fraud alert # Block/unblock users settings.
When you enable this setting:
* Users can report "I didn't initiate this request" in the Microsoft Authenticator app.
* Azure AD automatically blocks their account for MFA until an administrator reviews and unblocks it.
From Microsoft Learn ("Configure Azure AD Multi-Factor Authentication fraud alerts"):
"When users report a fraudulent authentication attempt, you can automatically block their account from future sign-ins until an administrator unblocks them." Therefore, configuring the Block/unblock users settings directly meets the goal.