CIS.M365.5.2.3.10 - (L1) Ensure Microsoft Authenticator on companion applications is disabled
Overview
Microsoft Authenticator functionality on companion applications, such as Outlook, is disabled.
When this feature is on, a user can approve a sign-in request from within a companion app on the same phone that is used to sign in. Approving on the device that started the request weakens the separation between the first factor and the second factor, and a compromised app or device can then complete both.
Disabling it means approvals are given only in the Microsoft Authenticator app itself.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Policies.
- Select Microsoft Authenticator and open the Configure tab.
- Set Microsoft Authenticator on companion applications to Disabled.
- Select Save.
Related links
- Microsoft Entra admin center - Authentication methods policies
- Enable Microsoft Authenticator on companion applications
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.10
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.10 |
| Severity | Low |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.10, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisAuthenticatorCompanionAppsDisabled |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.10.md