Wrong information about MFA and security on Azure Fundamentals course

Question

On Azure Fundamentals training module:
[https://learn.microsoft.com/en-us/training/modules/describe-azure-identity-access-security/3-authentication-methods
It states about MFA:
"With multifactor authentication enabled, an attacker who has a user's password would also need to have possession of their phone or their fingerprint to fully authenticate."
This is not totally true.
Attackers can build websites, that work as proxy and can disguise as legitimate MFA authentication pages. When user is authenticating (received phishing mail that directed user to this page), these websites can fool the user to enter their MFA code on the page, stealing and proxying it to the real Microsoft Login. This way, the attacker does not need to have possession of the phone or fingerprint to fully authenticate.

Can you fix or rephrase this information on the module?

Answer 1

Hello!

Where am I seeing this?

• Subject: Exam AZ-900: Microsoft Azure Fundamentals
• Learning Path: Azure Fundamentals: Describe Azure architecture and services
• Module: Describe Azure identity, access, and security
• Unit: 3 of 11 Describe Azure authentication methods

Multifactor authentication is not completely immune to attack

This is certainly true. Security is a scale on which you can achieve high degrees of security but it's very difficult to say that anything is completely immune to an attack. We've definitely seen some impressive examples of this in headlines over the past several years.

An adversary-in-the-middle (also known as MITM) attack could effectively capture the form (or factor) of identification that is provided by something that the user has. Fortunately, this is time sensitive and orders of magnitude more difficult than methods used to bypass something that the user knows, which makes this type of attack less common than those made on password checks.

We'll pass this suggestion along to the content team however there was recently a major effort to make the Azure Fundamentals content less technical in order to focus on concepts. As a result, a change may complicate the training material too much for an introductory course at this time.

Thank you very much for your feedback!