Authentication Method Policy - Microsoft Authenticator

Controls how Microsoft Authenticator is used for push and passwordless authentication, which users it applies to, and whether additional security details (app name, location, companion apps) appear in authentication prompts.

Settings this baseline controls

Setting	What it does
Method enabled	Specifies whether Microsoft Authenticator authentication method is enabled or disabled for the tenant. Learn more
OTP codes enabled	Determines whether users can use Microsoft Authenticator OTP tokens for authentication. Learn more
Included users	Groups and users explicitly included to use Microsoft Authenticator authentication method. Learn more
Excluded users	Groups and users explicitly excluded from using Microsoft Authenticator authentication method. Learn more
Show app name in notifications	Controls whether application context information is shown in Microsoft Authenticator notifications. Learn more
App name included users	Users and groups included for showing application context in Microsoft Authenticator. Learn more
App name excluded users	Users and groups excluded from showing application context in Microsoft Authenticator. Learn more
Show location in notifications	Controls whether geographic location information is shown in Microsoft Authenticator notifications. Learn more

5 more settings

Setting	What it does
Location included users	Users and groups included for showing location context in Microsoft Authenticator. Learn more
Location excluded users	Users and groups excluded from showing location context in Microsoft Authenticator. Learn more
Companion apps allowed	Controls whether companion applications can be used with Microsoft Authenticator. Learn more
Companion app included users	Users and groups included for using companion applications with Microsoft Authenticator. Learn more
Companion app excluded users	Users and groups excluded from using companion applications with Microsoft Authenticator. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this to the tenant, or through a scheme to every tenant you manage, so Microsoft Authenticator push notifications carry enough context for a user to tell a genuine sign-in from an attacker’s.

1. Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).

2. Turn on Method enabled for all users under Included users.

3. Turn on Show app name in notifications and Show location in notifications, both targeting all users. This lets someone spot a rogue approval request (“why is this from an app I don’t use, or a country I’ve never been to?”) instead of tapping Approve out of habit.

4. Leave Companion apps allowed on, and turn OTP codes enabled off. The baseline favours push and passwordless approval over Authenticator’s fallback numeric-code mode.

5. Save. Auto-remediation is safe to turn on: it only reapplies the notification content and targeting settings, and can’t lock anyone out of Authenticator itself.

Caution

Turning off OTP codes removes the option to type a numeric code instead of approving a push notification, which helps anyone with a poor data connection. Check that nobody depends on that fallback before you turn it off.

Check it worked

Passing means Entra ID → Authentication methods → Policies → Microsoft Authenticator shows the method enabled with app name and location both shown to all users. Users start seeing the requesting app’s name and an approximate location on every Authenticator approval prompt, alongside the usual number-matching challenge.

Standards this addresses

CISM365 5.2.3.1v8 6.3

NISTPR.AC-7IA-2IA-5

ISO 27001A.8.3.3

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→