As I have covered several times before, disabling basic authentication in one of the best things you can do in your O365 tenant for security.
MFA helps protect user’s account and prevents attacks. It is not perfect by any means but it is being improved. I’m a big fan of the Authenticator App. I try not to use the SMS or voice call options. Whenever I get a chance I always advocate the users I work with, to stick with the App. If your organization is yet to roll out MFA, it is time to take a hard look and make some drastic changes.
Microsoft in their November 18 Azure AD Identity blog revealed two new features for the Authenticator app. IMO, all O365 tenants should strongly consider enabling these two features below.
- Number matching in Microsoft Authenticator
- Additional context in Microsoft Authenticator
Number Matching
When a user responds to MFA challenge, they will see a number in the application or in the webpage which is challenging them and the user must enter this number in the Authenticator app to complete the process. This process is already part of the passwordless authentication method.
Additional Context
The Authenticator will also display the name of the app requesting MFA and also the user’s sign-in location. The sign-in location is based on the user’s public IP address. The location may not be accurate at times. This is because the IP location tagging and based on what I saw it is not the exact location of where the application’s traffic origin but usually close enough.
How to enable number matching with additional context in Azure AD
- Open Azure AD admin center(https://aad.portal.azure.com/)
- Click on the Security tab –> Authentication methods
- Select Microsoft Authenticator
- Toggle ENABLE to Yes
- Toggle TARGET to All users
- Depending on how you decide to roll out this feature, you can select a Azure AD group by selecting Select users, Select the group and follow along the next steps
- Click on the three dots and Configure
- Set
- Authentication mode = Any
- Require number matching = Enabled
- Show additional context in notifications = Enabled
- Click Done
- Click Save
In the drop down for ‘Require number matching’ and ‘Show additional context in notifications’, there is a ‘Microsoft Managed‘ option. It means this functionality will be enabled by default for all tenants after the feature is generally available. Currently it is in public preview.
Thank you for stopping by.✌