(L1) Ensure Microsoft Authenticator on companion applications is disabled

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.3.10

Overview

Microsoft Authenticator functionality on companion applications, such as Outlook, is disabled.

When this feature is on, a user can approve a sign-in request from within a companion app on the same phone that is used to sign in. Approving on the device that started the request weakens the separation between the first factor and the second factor, and a compromised app or device can then complete both.

Disabling it means approvals are given only in the Microsoft Authenticator app itself.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Authentication methods > Policies.
3. Select Microsoft Authenticator and open the Configure tab.
4. Set Microsoft Authenticator on companion applications to Disabled.
5. Select Save.

Related links

• Microsoft Entra admin center - Authentication methods policies
• Enable Microsoft Authenticator on companion applications
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.10

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.3.10
Severity	Low
Suite	CIS
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1111 Multi-Factor Authentication Interception
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.10
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:5.2.3.10, nist-800-53-r5:IA-2
PowerShell test	Test-MtCisAuthenticatorCompanionAppsDisabled
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.2.3.10.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.3.10.md