You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# How to use number matching in multifactor authentication (MFA) notifications (Preview) - Authentication Methods Policy
15
15
16
-
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. Number matching can be enabled by using the Azure portal or Microsoft Graph API.
16
+
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. The schema for the API to enable number match is currently being updated. **While the API is updated over the next two weeks, you should only use the Azure AD portal to enable number match.**
17
17
18
18
>[!NOTE]
19
19
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will be enabled by default for all tenants a few months after general availability (GA).<br>
@@ -25,6 +25,8 @@ Your organization will need to enable Authenticator (traditional second factor)
25
25
26
26
## Number matching
27
27
28
+
<!---check below with Mayur. The bit about the policy came from the number match FAQ at the end.--->
29
+
28
30
Number matching can be targeted to only a single group, which can be dynamic or nested. On-premises synchronized security groups and cloud-only security groups are supported for the Authentication Method Policy.
29
31
30
32
Number matching is available for the following scenarios. When enabled, all scenarios support number matching.
@@ -84,256 +86,7 @@ To create the registry key that overrides push notifications:
84
86
85
87
## Enable number matching
86
88
87
-
88
-
>[!NOTE]
89
-
>In Graph Explorer, ensure you've consented to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
90
-
91
-
Identify your single target group for the schema configuration. Then use the following API endpoint to change the numberMatchingRequiredState property under featureSettings to **enabled** and include or exclude groups:
| id | String | The authentication method policy identifier. |
105
-
| state | authenticationMethodState | Possible values are: **enabled**<br>**disabled**|
106
-
107
-
**RELATIONSHIPS**
108
-
109
-
| Relationship | Type | Description |
110
-
|--------------|------|-------------|
111
-
| includeTargets |[microsoftAuthenticatorAuthenticationMethodTarget](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget?view=graph-rest-beta&preserve-view=true) collection | A collection of users or groups who are enabled to use the authentication method |
112
-
| featureSettings |[microsoftAuthenticatorFeatureSettings](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget) collection | A collection of Microsoft Authenticator features. |
| authenticationMode | String | Possible values are:<br>**any**: Both passwordless phone sign-in and traditional second factor notifications are allowed.<br>**deviceBasedPush**: Only passwordless phone sign-in notifications are allowed.<br>**push**: Only traditional second factor push notifications are allowed. |
121
-
| id | String | Object ID of an Azure AD user or group. |
122
-
| targetType | authenticationMethodTargetType | Possible values are: **user**, **group**.|
| numberMatchingRequiredState | authenticationMethodFeatureConfiguration | Require number matching for MFA notifications. Value is ignored for phone sign-in notifications. |
133
-
| displayAppInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown application name in Microsoft Authenticator notification. |
134
-
| displayLocationInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown geographic location context in Microsoft Authenticator notification. |
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br> Please note: You will be able to only exclude one group for number matching. |
143
-
| includeTarget | featureTarget | A single entity that is included in this feature. <br> Please note: You will be able to only set one group for number matching. |
144
-
| State | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
145
-
146
-
### Feature Target properties
147
-
148
-
**PROPERTIES**
149
-
150
-
| Property | Type | Description |
151
-
|----------|------|-------------|
152
-
| id | String | ID of the entity targeted. |
153
-
| targetType | featureTargetType | The kind of entity targeted, such as group, role, or administrative unit. The possible values are: ‘group’, 'administrativeUnit’, ‘role’, unknownFutureValue’. |
154
-
155
-
>[!NOTE]
156
-
>Number matching can be enabled only for a single group.
157
-
158
-
### Example of how to enable number matching for all users
159
-
160
-
In **featureSettings**, you will need to change the **numberMatchingRequiredState** from **default** to **enabled**.
161
-
162
-
Note that the value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use **any**, but if you do not want to allow passwordless, use **push**.
163
-
164
-
>[!NOTE]
165
-
>For passwordless users, enabling or disabling number matching has no impact because it's already part of the passwordless experience.
166
-
167
-
You might need to patch the entire schema to prevent overwriting any previous configuration. In that case, do a GET first, update only the relevant fields, and then PATCH. The following example only shows the update to the **numberMatchingRequiredState** under **featureSettings**.
168
-
169
-
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
170
-
171
-
```json
172
-
//Retrieve your existing policy via a GET.
173
-
//Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.
To confirm this has applied, please run the GET request below using the endpoint below.
208
-
209
-
```http
210
-
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
211
-
```
212
-
213
-
### Example of how to enable number matching for a single group
214
-
215
-
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
216
-
Inside the **includeTarget**, you will need to change the **id** from **all_users** to the ObjectID of the group from the Azure AD portal.
217
-
218
-
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
219
-
220
-
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
257
-
```
258
-
259
-
### Example of removing the excluded group from number matching
260
-
261
-
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
262
-
You need to change the **id** of the **excludeTarget** to `00000000-0000-0000-0000-000000000000`.
263
-
264
-
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
265
-
266
-
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will be excluded from the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-authentication-passwordless-deployment.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -132,7 +132,7 @@ This method can also be used for easy recovery when the user has lost or forgott
132
132
133
133
### Technical considerations
134
134
135
-
**Active Directory Federation Services (AD FS) Integration** - When a user enables the Authenticator passwordless credential, authentication for that user defaults to sending a notification for approval. Users in a hybrid tenant are prevented from being directed to AD FS for sign-in unless they select "Use your password instead." This process also bypasses any on-premises Conditional Access policies, and pass-through authentication (PTA) flows. However, if a login_hint is specified, the user is forwarded to AD FS and bypasses the option to use the passwordless credential.
135
+
**Active Directory Federation Services (AD FS) Integration** - When a user enables the Authenticator passwordless credential, authentication for that user defaults to sending a notification for approval. Users in a hybrid tenant are prevented from being directed to AD FS for sign-in unless they select "Use your password instead." This process also bypasses any on-premises Conditional Access policies, and pass-through authentication (PTA) flows. However, if a login_hint is specified, the user is forwarded to AD FS and bypasses the option to use the passwordless credential. For non-Microsoft 365 applications which use AD FS for authentication, Azure AD Conditional Access policies will not be applied and you will need to set up access control policies within AD FS.
136
136
137
137
**MFA server** - End users enabled for multi-factor authentication through an organization's on-premises MFA server can create and use a single passwordless phone sign-in credential. If the user attempts to upgrade multiple installations (5 or more) of the Authenticator app with the credential, this change may result in an error.
0 commit comments