Disable Microsoft Authenticator on companion applications

Description

In the Microsoft Authenticator configuration of the Authentication methods policy, Microsoft Authenticator on companion applications (Authenticator Lite) is set to Disabled. Users complete MFA in Microsoft Authenticator itself or with another allowed method, not inside Outlook mobile.

The default is Microsoft managed, whose current value is enabled.

Rationale

Authenticator Lite puts the second factor inside the application it protects: whoever controls the phone and Outlook has both the mailbox session and the approval. It also does not support passkeys and depends on Outlook versions that the organisation may not manage.

Impact

Users who registered Authenticator Lite in Outlook must install Microsoft Authenticator or use another method. Check User registration details first.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Policies > Microsoft Authenticator.
3. On the Configure tab, read Microsoft Authenticator on companion applications.
4. Read-only alternative with Microsoft Graph (beta, scope Policy.Read.All): GET https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator, property featureSettings.companionAppAllowedState.state.
5. Fail if the state is Enabled or Microsoft managed (default).

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure.
3. Set Microsoft Authenticator on companion applications to Disabled and save. Graph equivalent: PATCH https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator with featureSettings.companionAppAllowedState.state set to disabled (send the whole configuration back).

Rollback

Set the setting back to Microsoft managed.

References

• Enable Authenticator Lite for Outlook mobile Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUTH-006 Show application name and location in Microsoft Authenticator notifications

People and lifecycle