{
  "id": "CB-M365-AUTH-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-014.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-014",
    "title": "Disable Microsoft Authenticator on companion applications",
    "finding": {
      "title": "Outlook mobile can act as an MFA authenticator",
      "description": "Authenticator Lite lets users approve MFA prompts or read codes inside Outlook mobile, an app that is not managed as an authenticator and runs on the same device as the mailbox."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "microsoft-authenticator",
      "authenticator-lite",
      "authentication-methods"
    ],
    "description": "In the Microsoft Authenticator configuration of the Authentication methods policy, **Microsoft\nAuthenticator on companion applications** (Authenticator Lite) is set to **Disabled**. Users\ncomplete MFA in Microsoft Authenticator itself or with another allowed method, not inside\nOutlook mobile.\n\nThe default is **Microsoft managed**, whose current value is enabled.\n",
    "rationale": "Authenticator Lite puts the second factor inside the application it protects: whoever controls\nthe phone and Outlook has both the mailbox session and the approval. It also does not support\npasskeys and depends on Outlook versions that the organisation may not manage.\n",
    "impact": "Users who registered Authenticator Lite in Outlook must install Microsoft Authenticator or use\nanother method. Check **User registration details** first.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Microsoft Authenticator > Configure > Microsoft Authenticator on companion applications",
      "default_value": "Microsoft managed (enabled)",
      "recommended_value": "Disabled"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Microsoft\n   Authenticator**.\n3. On the **Configure** tab, read **Microsoft Authenticator on companion applications**.\n4. Read-only alternative with Microsoft Graph (beta, scope `Policy.Read.All`):\n   `GET https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`,\n   property `featureSettings.companionAppAllowedState.state`.\n5. Fail if the state is **Enabled** or **Microsoft managed** (`default`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Microsoft\n   Authenticator** > **Configure**.\n3. Set **Microsoft Authenticator on companion applications** to **Disabled** and save.\nGraph equivalent: `PATCH https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator`\nwith `featureSettings.companionAppAllowedState.state` set to `disabled` (send the whole\nconfiguration back).\n",
      "rollback": "Set the setting back to **Microsoft managed**.\n"
    },
    "references": [
      {
        "title": "Enable Authenticator Lite for Outlook mobile",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-authenticator-lite",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}