{
  "id": "CB-M365-AUTH-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-006",
    "title": "Show application name and location in Microsoft Authenticator notifications",
    "finding": {
      "title": "Authenticator push notifications do not show the sign-in context",
      "description": "Users approve MFA prompts without seeing which application asks or where the sign-in comes from, so a prompt triggered by an attacker looks like any other."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "microsoft-authenticator",
      "mfa-fatigue",
      "authentication-methods"
    ],
    "description": "In the Authentication methods policy, Microsoft Authenticator is configured so that push and\npasswordless notifications show the name of the requesting application and the geographic\nlocation of the sign-in, for all users enabled for Authenticator. Number matching, which\nMicrosoft now enforces on every Authenticator push notification, completes the prompt.\n\nBoth **Show application name in push and passwordless notifications** and **Show geographic\nlocation in push and passwordless notifications** are set to **Enabled** (not **Microsoft\nmanaged**, whose current value is disabled) and target **All users** without exclusions.\n",
    "rationale": "MFA fatigue attacks send repeated prompts until the user approves one. Number matching forces\nthe user to look at the sign-in screen, and the application name and location give a reason to\nrefuse: a sign-in from another country to an unknown application is easy to spot.\n",
    "impact": "None known. The location comes from the IP address and can be approximate, especially behind a\nVPN or a mobile network; tell users so they do not report every mismatch. Context is not shown\nfor the NPS extension and AD FS adapter.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure",
      "default_value": "Microsoft managed (disabled)",
      "recommended_value": "Application name and geographic location both Enabled for All users"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Microsoft\n   Authenticator**.\n3. On the **Configure** tab, check **Show application name in push and passwordless\n   notifications** and **Show geographic location in push and passwordless notifications**.\n   **Require number matching for push notifications** shows **Enabled** and cannot be\n   changed: Microsoft enforces it.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId MicrosoftAuthenticator).AdditionalProperties.featureSettings`\n   (Graph: `GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`).\n   Look at `displayAppInformationRequiredState` and `displayLocationInformationRequiredState`.\n5. Fail if Microsoft Authenticator is enabled and either setting is **Disabled** or\n   **Microsoft managed** (`default`), does not include all users, or excludes a group.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Microsoft\n   Authenticator**.\n3. On the **Configure** tab, set **Status** to **Enabled** for **Show application name in push\n   and passwordless notifications**, target **All users**, and remove any exclusion.\n4. Do the same for **Show geographic location in push and passwordless notifications**.\n5. Select **Save**.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`\nwith both `featureSettings` entries set to `\"state\": \"enabled\"` and `includeTarget` set to\n`all_users` (GET the configuration first and send it back whole).\n",
      "rollback": "Set the setting back to **Microsoft managed**.\n"
    },
    "references": [
      {
        "title": "Use additional context in Authenticator notifications",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "How number matching works in MFA push notifications for Authenticator",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-number-match",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.3v2",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1621"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-007",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-008",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-014",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}