# (L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue

Microsoft Authenticator is enabled for all users and its push notifications show the application name and the geographic location of the sign-in request.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Authentication methods · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.1
```

## Overview

Microsoft Authenticator is enabled for all users and its push notifications show the application name and the geographic location of the sign-in request.

In an MFA fatigue attack, an attacker who has a user's password triggers repeated push prompts until the user approves one. Showing which application is signing in and from where gives the user the information needed to recognise and deny a request they did not start.

The change affects the Authenticator prompt only. Users see extra context, and number matching stays in place.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods).
3. Select **Microsoft Authenticator**, set **Enable** to on and target **All users**.
4. On the **Configure** tab, set **Show application name in push and passwordless notifications** to **Enabled** and target **All users**.
5. Set **Show geographic location in push and passwordless notifications** to **Enabled** and target **All users**.
6. Select **Save**.

#### Related links

* [Microsoft Entra admin center - Authentication methods policies](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)
* [Use additional context in Microsoft Authenticator notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context)
* [How number matching works in multifactor authentication push notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-number-match)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.1](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1621 Multi-Factor Authentication Request Generation |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.1, nist-800-53-r5:IA-2 |
| PowerShell test | [Test-MtCisAuthenticatorFatigueProtection](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.1.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.1.md)