# (L1) Ensure Microsoft Authenticator on companion applications is disabled

Microsoft Authenticator functionality on companion applications, such as Outlook, is disabled.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.10

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Authentication methods · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.10
```

## Overview

Microsoft Authenticator functionality on companion applications, such as Outlook, is disabled.

When this feature is on, a user can approve a sign-in request from within a companion app on the same phone that is used to sign in. Approving on the device that started the request weakens the separation between the first factor and the second factor, and a compromised app or device can then complete both.

Disabling it means approvals are given only in the Microsoft Authenticator app itself.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods).
3. Select **Microsoft Authenticator** and open the **Configure** tab.
4. Set **Microsoft Authenticator on companion applications** to **Disabled**.
5. Select **Save**.

#### Related links

* [Microsoft Entra admin center - Authentication methods policies](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)
* [Enable Microsoft Authenticator on companion applications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-authenticator-lite)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.10](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.10 |
| Severity | Low |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.10, nist-800-53-r5:IA-2 |
| PowerShell test | [Test-MtCisAuthenticatorCompanionAppsDisabled](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.10.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.10.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.10.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.10.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.10.md)