Description
In the Authentication methods policy, Allow use of Microsoft Authenticator OTP is set to No. Users of Microsoft Authenticator then complete MFA with a number-matched push notification or an Authenticator passkey, never with a typed time-based code.
Third-party software OATH tokens and hardware OATH tokens are separate methods in the policy; keep them disabled unless a documented population needs them.
Rationale
A one-time code shows no context and has no binding to the sign-in page: a phishing proxy asks for it and replays it within its validity window. Push with number matching at least shows the application, location and a number from the real sign-in screen.
Impact
Users can no longer sign in when the phone has no network connection, since push needs one. The NPS extension relies on codes for some VPN scenarios; check those first. Users with a passkey in Authenticator are not affected.
Setting
| Location | Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure > Allow use of Microsoft Authenticator OTP |
| Default | Yes |
| Recommended | No |
Audit
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
- Browse to Entra ID > Authentication methods > Policies and select Microsoft Authenticator.
- On the Configure tab, read Allow use of Microsoft Authenticator OTP.
- Read-only alternative with Microsoft Graph PowerShell (scope
Policy.Read.All):(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId MicrosoftAuthenticator).AdditionalProperties.isSoftwareOathEnabled - Fail if the setting is Yes (
isSoftwareOathEnabledistrue).
Remediation
- Check the NPS extension and other code-based integrations, and move their users to push.
- Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
- Browse to Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure.
- Set Allow use of Microsoft Authenticator OTP to No and select Save.
Graph equivalent:
PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticatorwith"isSoftwareOathEnabled": false(send the whole configuration back).
Rollback
Set Allow use of Microsoft Authenticator OTP back to Yes.
References
- How to migrate MFA and SSPR policy settings to the Authentication methods policy Microsoft, vendor-doc, accessed 2026-10-24
- Authentication methods in Microsoft Entra ID - Microsoft Authenticator app Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | IA-5 | related |
| NIST SP 800-53 Rev. 55.1.1 | IA-2(8) | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1557 |
| MITRE ATT&CK | T1111 |
Related controls
- related
CB-M365-AUTH-006Show application name and location in Microsoft Authenticator notifications - related
CB-M365-AUTH-009Complete the migration to the Authentication methods policy
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
