CISA.MS.AAD.3.3 - If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Overview

If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Rationale: This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises.

Remediation action:

If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

1. In Entra ID, click Security > Authentication Methods > Microsoft Authenticator.
2. Click the Configure tab.
3. For Allow use of Microsoft Authenticator OTP select No.
4. Under Show application name in push and passwordless notifications select Status > Enabled and Target > Include > All users.
5. Under Show geographic location in push and passwordless notifications select Status > Enabled and Target > Include > All users.
6. Select Save.

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.3v2
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.3
Severity	Medium
Suite	CISA
Category	Entra ID P1
PowerShell test	Test-MtCisaAuthenticatorContext
Tags	CISA, CISA.MS.AAD.3.3, Entra ID P1, MS.AAD, MS.AAD.3.3

Source

• Pester test: tests/cisa/entra/Test-MtCisaAuthenticatorContext.Tests.ps1
• PowerShell source: powershell/public/cisa/entra/Test-MtCisaAuthenticatorContext.ps1