CIS.M365.5.2.3.1 - (L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue
Overview
Microsoft Authenticator is enabled for all users and its push notifications show the application name and the geographic location of the sign-in request.
In an MFA fatigue attack, an attacker who has a user's password triggers repeated push prompts until the user approves one. Showing which application is signing in and from where gives the user the information needed to recognise and deny a request they did not start.
The change affects the Authenticator prompt only. Users see extra context, and number matching stays in place.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Policies.
- Select Microsoft Authenticator, set Enable to on and target All users.
- On the Configure tab, set Show application name in push and passwordless notifications to Enabled and target All users.
- Set Show geographic location in push and passwordless notifications to Enabled and target All users.
- Select Save.
Related links
- Microsoft Entra admin center - Authentication methods policies
- Use additional context in Microsoft Authenticator notifications
- How number matching works in multifactor authentication push notifications
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1621 Multi-Factor Authentication Request Generation |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.1, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisAuthenticatorFatigueProtection |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.1.md