If Microsoft Authenticator is enabled, it SHALL be configured to show login context information

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Part of CISA · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.3.3

Overview

If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Rationale: This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises.

Remediation action:

If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

1. In Entra ID, click Security > Authentication Methods > Microsoft Authenticator.
2. Click the Configure tab.
3. For Allow use of Microsoft Authenticator OTP select No.
4. Under Show application name in push and passwordless notifications select Status > Enabled and Target > Include > All users.
5. Under Show geographic location in push and passwordless notifications select Status > Enabled and Target > Include > All users.
6. Select Save.

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.3v2
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.3.3
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1110 Brute Force, T1621 Multi-Factor Authentication Request Generation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.3
Criticality	SHALL
Upstream requirement	MS.AAD.3.3v2
Supports controls	cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(13)
PowerShell test	Test-MtCisaAuthenticatorContext
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.3.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.3.md