Detections
Analytics

5.2.3.10 Ensure Microsoft Authenticator on companion applications is disabled

Information

Microsoft Entra ID includes a feature called Authenticator Lite, which embeds a subset of Microsoft Authenticator functionality into companion applications such as Outlook mobile. When enabled, users can satisfy MFA requirements using push notifications or time-based one-time passcodes (TOTP) directly from the companion application without installing the standalone Microsoft Authenticator app.

The recommended state is Microsoft Authenticator on companion applications set to Disabled.

Authenticator Lite does not support application name or geographic location context in push notifications, regardless of tenant-wide Authenticator feature settings. These are key defenses against MFA fatigue attacks that are only available in the full Microsoft Authenticator app. Authenticator Lite also does not satisfy Conditional Access authentication strength requirements, does not support passwordless authentication, and does not support SSPR via push notifications. Disabling this feature ensures users authenticate through the full Microsoft Authenticator app where all available security protections are active.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Authentication methods and select Policies.
 - Under Method select Microsoft Authenticator.
 - Select Configure.
 - Set Microsoft Authenticator on companion applications : Status to Disabled.
 - Select Save.

Impact:

Users who have registered Authenticator Lite as their only MFA method will be unable to complete MFA until they install and register the standalone Microsoft Authenticator app. Administrators should communicate this change in advance and verify that affected users have registered an alternative MFA method before disabling this feature to avoid authentication lockouts.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2)

Plugin: microsoft_azure

Control ID: 7565caebb6a6c7abbbe0a6e578efe16e040a796c90c820c8f2bafce6b61e6c78