Investigate and remediate multiple denied MFA push requests in Okta

Investigate multiple denied MFA requests from a user in Okta and take appropriate actions on the account. If there are more than five denied MFA push requests for the same user within ten minutes, analyze the alert details and the affected user account. Notify the Teams security channel with an adaptive card containing alert details and a case link for remediation. Update the Teams message with the latest status after taking actions.

Created by

Claudia Kinsella