How to test authentication rate limiting and captchas and code on MS authenticator or any other way to do this as an Security admin?

Question

How to test authentication rate limiting and captchas and code on MS authenticator or any other way to do this as an Security admin?

Vinod Survase 4,811

Shweta Mathur 30,446 Reputation points Microsoft Employee Moderator

2023-09-26T06:14:48.2166667+00:00

Hi @Vinod Survase ,

Thanks for reaching out.

Could you please elaborate more on this.

Are you trying to do performance testing on Authenticator app. Please clarify the specific scenario you're aiming to accomplish so that I can assist you more effectively.

Also, I didn't get what do you mean by rate limiting here. Could you please elaborate this further?

Thanks,

Shweta
Vinod Survase 4,811 Reputation points

2023-09-27T14:59:57.6166667+00:00

Hi Shweta Mathur

Thanks for reply. I mean to say is the frequency of the codes and captcha's which will rotate after 30 seconds but I was looking for a way if someone used that respective code or captcha in any of the session or login attempts so that we can keep track of it and may be it will help to find out whether it was legitimate request or not.
Shweta Mathur 30,446 Reputation points Microsoft Employee Moderator

2023-10-03T09:51:08.3633333+00:00

@Vinod Survase

To keep track of the usage of codes and captchas, you can use the sign-in logs in Azure AD. You can apply filters to the sign-in logs to see where the continuous access evaluation (CAE) is being applied or not. The sign-in logs contain information on success as well as failure events. You can use filters to narrow your search. For example, if a user signed in to Teams, you can use the application filter and set it to Teams. Admins may need to check the sign-ins from both interactive and non-interactive tabs to locate the specific sign-in.

Your answer

Shweta Mathur 30,446 Reputation points Microsoft Employee Moderator

2023-09-26T06:14:48.2166667+00:00

Hi @Vinod Survase ,

Thanks for reaching out.

Could you please elaborate more on this.

Are you trying to do performance testing on Authenticator app. Please clarify the specific scenario you're aiming to accomplish so that I can assist you more effectively.

Also, I didn't get what do you mean by rate limiting here. Could you please elaborate this further?

Thanks,

Shweta
Vinod Survase 4,811 Reputation points

2023-09-27T14:59:57.6166667+00:00

Hi Shweta Mathur

Thanks for reply. I mean to say is the frequency of the codes and captcha's which will rotate after 30 seconds but I was looking for a way if someone used that respective code or captcha in any of the session or login attempts so that we can keep track of it and may be it will help to find out whether it was legitimate request or not.
Shweta Mathur 30,446 Reputation points Microsoft Employee Moderator

2023-10-03T09:51:08.3633333+00:00

@Vinod Survase

To keep track of the usage of codes and captchas, you can use the sign-in logs in Azure AD. You can apply filters to the sign-in logs to see where the continuous access evaluation (CAE) is being applied or not. The sign-in logs contain information on success as well as failure events. You can use filters to narrow your search. For example, if a user signed in to Teams, you can use the application filter and set it to Teams. Admins may need to check the sign-ins from both interactive and non-interactive tabs to locate the specific sign-in.

Share via

How to test authentication rate limiting and captchas and code on MS authenticator or any other way to do this as an Security admin?

Your answer