Microsoft Azure Active Directory MFA Number matching comes in 2023

Andres Bohren

2022-11-16

Hi All,

Basic Authentication has been mostly disabled. And Attackers now search for new ways to compromise M365 Accounts.

If you use Microsoft Authenticator Push Notifications - good for you. There is a thing called “MFA Fatique” that Attackers use to gain access. They send so many Push Requests until a user is annoyed and clicks on “Approve”.

As anounced in the Article below, the MFA Number Matching will be enabled for all M365 Tenants starting end of February 2023. This will prevent these Attacks as the User needs to know the Number from the Request to Approve the MFA Signin.

Defend your users from MFA fatigue attacks

How to use number matching in multifactor authentication (MFA) notifications - Authentication methods policy

MS Learn how-to-mfa-number-match

Go to Authentication Methods in your Azure Active Directory Tenant

I have enabled Number Matching for a Group in my Tenant

That is the Request after login in to https://office.com

And this is the Screen on the Microsoft Authenticator on the Smartphone.

Please note that i have also enabled the following Settings:

Show Application Name in push and passwordless notifications
Show geographic location in push and passwordless notifications

Regards
Andres Bohren

Andres works as a Senior Microsoft Cloud Engineer/Architect for midsize to large Enterprises at isolutions in Switzerland. He has a special focus on M365 including Identity, Messaging, Communication, Security and PowerShell but also some Azure Technologies. He is Co-Organisator of the Microsoft 365 Community Schweiz Meetup group and was Speaker at several other Meetups or Conferences. He likes good Food, his Bike and nice Dive spots all over the World.