(L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue
CIS.M365.5.2.3.1MediumEntra IDAuthentication methodsPreview 3.0
Part of CIS · Entra ID · Authentication methods · All checks
Invoke-Maester -TestId CIS.M365.5.2.3.1Overview
Section titled “Overview”Microsoft Authenticator is enabled for all users and its push notifications show the application name and the geographic location of the sign-in request.
In an MFA fatigue attack, an attacker who has a user’s password triggers repeated push prompts until the user approves one. Showing which application is signing in and from where gives the user the information needed to recognise and deny a request they did not start.
The change affects the Authenticator prompt only. Users see extra context, and number matching stays in place.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Policies.
- Select Microsoft Authenticator, set Enable to on and target All users.
- On the Configure tab, set Show application name in push and passwordless notifications to Enabled and target All users.
- Set Show geographic location in push and passwordless notifications to Enabled and target All users.
- Select Save.
Related links
Section titled “Related links”- Microsoft Entra admin center - Authentication methods policies
- Use additional context in Microsoft Authenticator notifications
- How number matching works in multifactor authentication push notifications
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.1
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1621 Multi-Factor Authentication Request Generation |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.1, nist-800-53-r5:IA-2 |
| PowerShell test | Test-MtCisAuthenticatorFatigueProtection |
| Services | Graph |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.5.2.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.1.md