Show application name and location in Microsoft Authenticator notifications

Description

In the Authentication methods policy, Microsoft Authenticator is configured so that push and passwordless notifications show the name of the requesting application and the geographic location of the sign-in, for all users enabled for Authenticator. Number matching, which Microsoft now enforces on every Authenticator push notification, completes the prompt.

Both Show application name in push and passwordless notifications and Show geographic location in push and passwordless notifications are set to Enabled (not Microsoft managed, whose current value is disabled) and target All users without exclusions.

Rationale

MFA fatigue attacks send repeated prompts until the user approves one. Number matching forces the user to look at the sign-in screen, and the application name and location give a reason to refuse: a sign-in from another country to an unknown application is easy to spot.

Impact

None known. The location comes from the IP address and can be approximate, especially behind a VPN or a mobile network; tell users so they do not report every mismatch. Context is not shown for the NPS extension and AD FS adapter.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Policies and select Microsoft Authenticator.
3. On the Configure tab, check Show application name in push and passwordless notifications and Show geographic location in push and passwordless notifications. Require number matching for push notifications shows Enabled and cannot be changed: Microsoft enforces it.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): (Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId MicrosoftAuthenticator).AdditionalProperties.featureSettings (Graph: GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator). Look at displayAppInformationRequiredState and displayLocationInformationRequiredState.
5. Fail if Microsoft Authenticator is enabled and either setting is Disabled or Microsoft managed (default), does not include all users, or excludes a group.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Policies > Microsoft Authenticator.
3. On the Configure tab, set Status to Enabled for Show application name in push and passwordless notifications, target All users, and remove any exclusion.
4. Do the same for Show geographic location in push and passwordless notifications.
5. Select Save. Graph equivalent: PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator with both featureSettings entries set to "state": "enabled" and includeTarget set to all_users (GET the configuration first and send it back whole).

Rollback

Set the setting back to Microsoft managed.

References

• Use additional context in Authenticator notifications Microsoft, vendor-doc, accessed 2026-10-24
• How number matching works in MFA push notifications for Authenticator Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-007 Disable one-time passcodes in Microsoft Authenticator
• related CB-M365-AUTH-008 Let all users report suspicious MFA prompts
• related CB-M365-AUTH-014 Disable Microsoft Authenticator on companion applications

People and lifecycle