# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUTH-006
title: Show application name and location in Microsoft Authenticator notifications
finding:
  title: Authenticator push notifications do not show the sign-in context
  description: Users approve MFA prompts without seeing which application asks or where the sign-in comes from, so a prompt triggered by an attacker looks like any other.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [mfa, microsoft-authenticator, mfa-fatigue, authentication-methods]

description: |
  In the Authentication methods policy, Microsoft Authenticator is configured so that push and
  passwordless notifications show the name of the requesting application and the geographic
  location of the sign-in, for all users enabled for Authenticator. Number matching, which
  Microsoft now enforces on every Authenticator push notification, completes the prompt.

  Both **Show application name in push and passwordless notifications** and **Show geographic
  location in push and passwordless notifications** are set to **Enabled** (not **Microsoft
  managed**, whose current value is disabled) and target **All users** without exclusions.
rationale: |
  MFA fatigue attacks send repeated prompts until the user approves one. Number matching forces
  the user to look at the sign-in screen, and the application name and location give a reason to
  refuse: a sign-in from another country to an unknown application is easy to spot.
impact: |
  None known. The location comes from the IP address and can be approximate, especially behind a
  VPN or a mobile network; tell users so they do not report every mismatch. Context is not shown
  for the NPS extension and AD FS adapter.
setting:
  location: Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure
  default_value: Microsoft managed (disabled)
  recommended_value: Application name and geographic location both Enabled for All users

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Microsoft
       Authenticator**.
    3. On the **Configure** tab, check **Show application name in push and passwordless
       notifications** and **Show geographic location in push and passwordless notifications**.
       **Require number matching for push notifications** shows **Enabled** and cannot be
       changed: Microsoft enforces it.
    4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):
       `(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId MicrosoftAuthenticator).AdditionalProperties.featureSettings`
       (Graph: `GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`).
       Look at `displayAppInformationRequiredState` and `displayLocationInformationRequiredState`.
    5. Fail if Microsoft Authenticator is enabled and either setting is **Disabled** or
       **Microsoft managed** (`default`), does not include all users, or excludes a group.

remediation:
  manual: |
    1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy
       Administrator.
    2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Microsoft
       Authenticator**.
    3. On the **Configure** tab, set **Status** to **Enabled** for **Show application name in push
       and passwordless notifications**, target **All users**, and remove any exclusion.
    4. Do the same for **Show geographic location in push and passwordless notifications**.
    5. Select **Save**.
    Graph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`
    with both `featureSettings` entries set to `"state": "enabled"` and `includeTarget` set to
    `all_users` (GET the configuration first and send it back whole).
  rollback: |
    Set the setting back to **Microsoft managed**.

references:
  - title: Use additional context in Authenticator notifications
    url: https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: How number matching works in MFA push notifications for Authenticator
    url: https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-number-match
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Microsoft Entra ID baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.2.3.1"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.AAD.3.3v2
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-2(2)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-5
    relation: related
threats:
  - framework: mitre-attack
    id: T1621
related_controls:
  - id: CB-M365-AUTH-007
    type: related
  - id: CB-M365-AUTH-008
    type: related
  - id: CB-M365-AUTH-014
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24