  Approximately 61% of cyber attacks involve adversaries in possession of valid
credentials. Attackers acquire credentials through various means, including
phishing, dark web data drops, password reuse, etc. Multi-factor authentication
(MFA) helps to thwart attacks that use valid credentials, but attackers still
commonly breach systems by tricking users into accepting MFA step up requests
through techniques, such as ``MFA Bombing'', where multiple requests are sent
to a user until they accept one. Currently, there are several solutions to this
problem, each with varying levels of security and increasing invasiveness on
user devices. This paper proposes a token-based enrollment architecture that is
less invasive to user devices than mobile device management, but still offers
strong protection against use of stolen credentials and MFA attacks.
