Passwordless authentication - Brute force notification

Let's say if a hacker comes to know that a company is using Microsoft passwordless authentication and tries to enter an employee's Microsoft email address repeatedly to login, and this is generating a repeated Time-sensitive approve notification on the user mobile Microsoft authenticator. How to address these brute force attempts?

address authentication authenticator brute cybersecurity email employee hacker login microsoft microsoft authenticator mobile notification passwordless passwordless authentication sensitive