Microsoft Entra user with authentication phone details modified by another user

This issue is rated medium severity because it indicates a potential security vulnerability that could be exploited by attackers. The modification of authentication phone details enables an attacker to receive multifactor authentication messages for a compromised account, which can support later attacker activity such as persistence and reconnaissance.

Attackers could use this vulnerability to gain unauthorized access to a Microsoft Entra user's account. By modifying the user's authentication phone details, an attacker may receive multifactor authentication messages for a compromised account, which enables them to bypass security controls and maintain persistence.

Cayosoft Guardian continuously monitors changes to Microsoft Entra user settings, including multifactor authentication configurations. When an unauthorized change is detected, Guardian flags it as a security issue and provides visibility into the activity of the user who made the change.

Cayosoft Guardian alerts administrators to potential security issues, enabling them to investigate and take corrective action. This includes reviewing the activity of the user who made the change and verifying its legitimacy, as well as showing change history and supporting investigation.