Detections
Analytics

MS.AAD.3.3v2 - If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Information

This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises.

Solution

If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

1. In Microsoft Entra admin center, click Protection > Authentication methods > Microsoft Authenticator.
2. Click the Configure tab.
3. For Allow use of Microsoft Authenticator OTP select No.
4. Under Show application name in push and passwordless notifications select Status > Enabled and Target > Include > All users.
5. Under Show geographic location in push and passwordless notifications select Status > Enabled and Target > Include > All users.
6. Select Save

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2), 800-53|IA-2(8), 800-53|IA-2(13), 800-53|IA-5c., 800-53|IA-5h.

Plugin: microsoft_azure

Control ID: e519a2a6515c11454459baea6b28de61c7fb18f6c05c5ac01470d8b07e09b5b2