Control: 5.2.3.1 Ensure Microsoft Authenticator is configured to protect against MFA fatigue

Description

Microsoft provides supporting settings to enhance the configuration of the Microsoft Authenticator application. These settings provide users with additional information and context when they receive MFA passwordless and push requests, including the geographic location of the request, the requesting application, and a requirement for number matching.

Ensure the following are Enabled.

Require number matching for push notifications
Show application name in push and passwordless notifications
Show geographic location in push and passwordless notifications

Remediation

To remediate using the UI:

Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
Click to expand Protection > Authentication methods select Policies.
Select Microsoft Authenticator.
Under Enable and Target ensure the setting is set to Enable.
Select Configure.
Set the following Microsoft Authenticator settings:
- Require number matching for push notifications Status is set to Enabled, Target All users
- Show application name in push and passwordless notifications is set to Enabled, Target All users
- Show geographic location in push and passwordless notifications is set to Enabled, Target All users.

Note: Valid groups such as break glass accounts can be excluded per organization policy.

Default Value

Microsoft-managed

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v500_5_2_3_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v500_5_2_3_1 --share

SQL

This control uses a named query:

with tenant_list as (
  select distinct on (tenant_id) tenant_id, _ctx
  from azuread_user
),
authentication_method_policy as (
  select
    tenant_id,
    count(*) as authentication_method_policy_count
  from
    azuread_authentication_method_policy,
    jsonb_array_elements(authentication_method_configurations) as cfg
  where
    cfg ->> 'id' = 'MicrosoftAuthenticator'
    and cfg ->> 'state' = 'enabled'
    and exists (
      select 1
      from jsonb_array_elements(cfg -> 'includeTargets') as t
      where t ->> 'id' = 'all_users'
    )
    and cfg -> 'featureSettings' -> 'numberMatchingRequiredState' ->> 'state' = 'enabled'
    and cfg -> 'featureSettings' -> 'numberMatchingRequiredState' -> 'includeTarget' ->> 'id' = 'all_users'
    and cfg -> 'featureSettings' -> 'displayAppInformationRequiredState' ->> 'state' = 'enabled'
    and cfg -> 'featureSettings' -> 'displayAppInformationRequiredState' -> 'includeTarget' ->> 'id' = 'all_users'
    and cfg -> 'featureSettings' -> 'displayLocationInformationRequiredState' ->> 'state' = 'enabled'
    and cfg -> 'featureSettings' -> 'displayLocationInformationRequiredState' -> 'includeTarget' ->> 'id' = 'all_users'
  group
    by tenant_id
)
select
  t.tenant_id as resource,
  case
    when authentication_method_policy_count > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when authentication_method_policy_count > 0 then t.tenant_id || ' has Microsoft Authenticator enabled and configured with number matching, application name display, and location display enforced for all users to protect against MFA fatigue.'
    else t.tenant_id || ' does not have Microsoft Authenticator fully configured with number matching, application name display, and location display for all users to protect against MFA fatigue.'
  end as reason
  , t.tenant_id as tenant_id
from
  tenant_list as t
  left join authentication_method_policy as p on p.tenant_id = t.tenant_id;

Control: 5.2.3.1 Ensure Microsoft Authenticator is configured to protect against MFA fatigue

Description

Remediation

Default Value

Usage

SQL

Tags