If a user recieves an authentication prompt on their mobile device and REFUSES to authenticate, this generates a fraud alert sent by Microsoft to the global administrators. This will also lock their account on the Azure side, meaning they will be unable to sign in or approve any authentication requests. This is different than a user account being locked in Active Directory and will require you to unblock their account in the Azure (Entra) admin center. Also, before doing this, check the sign-in logs on their user profile for the log-in request location and IP, and confirm with the user that they were actually the ones that denied the request before unlocking.


Multifactor authentication - Microsoft Entra admin center