{
  "id": "CB-M365-AUTH-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-007.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-007",
    "title": "Disable one-time passcodes in Microsoft Authenticator",
    "finding": {
      "title": "Microsoft Authenticator one-time passcodes are allowed",
      "description": "Users can type a six-digit code from Authenticator instead of answering a number-matched notification, and a phishing page can collect and replay that code."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "microsoft-authenticator",
      "oath",
      "authentication-methods"
    ],
    "description": "In the Authentication methods policy, **Allow use of Microsoft Authenticator OTP** is set to\n**No**. Users of Microsoft Authenticator then complete MFA with a number-matched push\nnotification or an Authenticator passkey, never with a typed time-based code.\n\nThird-party software OATH tokens and hardware OATH tokens are separate methods in the policy;\nkeep them disabled unless a documented population needs them.\n",
    "rationale": "A one-time code shows no context and has no binding to the sign-in page: a phishing proxy asks\nfor it and replays it within its validity window. Push with number matching at least shows the\napplication, location and a number from the real sign-in screen.\n",
    "impact": "Users can no longer sign in when the phone has no network connection, since push needs one.\nThe NPS extension relies on codes for some VPN scenarios; check those first. Users with a\npasskey in Authenticator are not affected.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure > Allow use of Microsoft Authenticator OTP",
      "default_value": "Yes",
      "recommended_value": "No"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Microsoft\n   Authenticator**.\n3. On the **Configure** tab, read **Allow use of Microsoft Authenticator OTP**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId MicrosoftAuthenticator).AdditionalProperties.isSoftwareOathEnabled`\n5. Fail if the setting is **Yes** (`isSoftwareOathEnabled` is `true`).\n"
    },
    "remediation": {
      "manual": "1. Check the NPS extension and other code-based integrations, and move their users to push.\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Microsoft\n   Authenticator** > **Configure**.\n4. Set **Allow use of Microsoft Authenticator OTP** to **No** and select **Save**.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`\nwith `\"isSoftwareOathEnabled\": false` (send the whole configuration back).\n",
      "rollback": "Set **Allow use of Microsoft Authenticator OTP** back to **Yes**.\n"
    },
    "references": [
      {
        "title": "How to migrate MFA and SSPR policy settings to the Authentication methods policy",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Authentication methods in Microsoft Entra ID - Microsoft Authenticator app",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(8)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      },
      {
        "framework": "mitre-attack",
        "id": "T1111"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-006",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-009",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}