You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# How to use additional context in Microsoft Authenticator app notifications (Preview) - Authentication Methods Policy
15
15
16
-
This article covers how to improve the security of user sign-in by adding the application and location in Microsoft Authenticator app push notifications.
16
+
This topic covers how to improve the security of user sign-in by adding the application name and geographic location of the sign-in to Microsoft Authenticator push and passwordless notifications. The schema for the API to enable application name and geographic location is currently being updated. **While the API is updated over the next two weeks, you should only use the Azure AD portal to enable application name and geographic location.**
17
17
18
18
## Prerequisites
19
19
20
-
Your organization will need to enable Authenticator app push notifications for some users or groups using the new Authentication Methods Policy API.
20
+
Your organization will need to enable Microsoft Authenticator push notifications for some users or groups by using the Azure AD portal. The new Authentication Methods Policy API will soon be ready as another configuration option.
21
21
22
22
>[!NOTE]
23
23
>Additional context can be targeted to only a single group, which can be dynamic or nested. On-premises synchronized security groups and cloud-only security groups are supported for the Authentication Method Policy.
24
24
25
25
## Passwordless phone sign-in and multifactor authentication
26
26
27
-
When a user receives a Passwordless phone sign-in or MFA push notification in the Authenticator app, they'll see the name of the application that requests the approval and the location based on the IP address where the sign-in originated from.
27
+
When a user receives a passwordless phone sign-in or MFA push notification in the Authenticator app, they'll see the name of the application that requests the approval and the location based on the IP address where the sign-in originated from.
28
28
29
29
:::image type="content" border="false" source="./media/howto-authentication-passwordless-phone/location.png" alt-text="Screenshot of additional context in the MFA push notification.":::
30
30
31
31
The additional context can be combined with [number matching](how-to-mfa-number-match.md) to further improve sign-in security.
32
32
33
33
:::image type="content" border="false" source="./media/howto-authentication-passwordless-phone/location-with-number-match.png" alt-text="Screenshot of additional context with number matching in the MFA push notification.":::
34
34
35
-
### Policy schema changes
35
+
##Enable additional context
36
36
37
-
>[!NOTE]
38
-
>In Graph Explorer, ensure you've consented to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
37
+
To enable application name or geographic location, complete the following steps:
39
38
40
-
Identify a single target group for the schema configuration. Then use the following API endpoint to change the displayAppInformationRequiredState property to **enabled**:
39
+
1. In the Azure AD portal, click **Security** > **Authentication methods** > **Microsoft Authenticator**.
40
+
1. On the **Basics** tab, click **Yes** and **All users** to enable the policy for everyone, and change **Authentication mode** to **Any**.
41
+
42
+
Only users who are enabled for Microsoft Authenticator here can be included in the policy to show the application name or geographic location of the sign-in, or excluded from it. Users who aren't enabled for Microsoft Authenticator can't see application name or geographic location.
:::image type="content" border="true" source="./media/how-to-mfa-additional-context/enable-settings-additional-context.png" alt-text="Screenshot of how to enable Microsoft Authenticator settings for Any authentication mode.":::
43
45
44
-
>[!NOTE]
45
-
>For Passwordless phone sign-in, the Authenticator app does not retrieve policy information just in time for each sign-in request. Instead, the Authenticator app does a best effort retrieval of the policy once every 7 days. We understand this limitation is less than ideal and are working to optimize the behavior. In the meantime, if you want to force a policy update to test using additional context with Passwordless phone sign-in, you can remove and re-add the account in the Authenticator app.
| authenticationMode | String | Possible values are:<br>**any**: Both passwordless phone sign-in and traditional second factor notifications are allowed.<br>**deviceBasedPush**: Only passwordless phone sign-in notifications are allowed.<br>**push**: Only traditional second factor push notifications are allowed. |
70
-
| ID | String | Object ID of an Azure AD user or group. |
71
-
| targetType | authenticationMethodTargetType | Possible values are: **user**, **group**.<br>You can only set one group or user for additional context. |
72
-
| displayAppInformationRequiredState | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
46
+
1. On the **Configure** tab, for **Show application name in push and passwordless notifications (Preview)**, change **Status** to **Enabled**, choose who to include or exclude from the policy, and click **Save**.
73
47
74
-
>[!NOTE]
75
-
>Additional context can only be enabled for a single group.
76
-
77
-
#### Example of how to enable additional context for all users
78
-
79
-
Change the **displayAppInformationRequiredState** from **default** to **enabled**.
80
-
81
-
The value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we'll use **any**, but if you don't want to allow passwordless, use **push**.
82
-
83
-
You need to PATCH the entire includeTarget to prevent overwriting any previous configuration. In that case, do a GET first, update only the relevant fields, and then PATCH. The following example only shows the update to the **displayAppInformationRequiredState**.
84
-
85
-
```json
86
-
//Retrieve your existing policy via a GET.
87
-
//Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.
To confirm this update has applied, run the GET request below using the endpoint below.
110
-
GET - https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
111
-
112
-
113
-
#### Example of how to enable additional context for a single group
114
-
115
-
Change the **displayAppInformationRequiredState** value from **default** to **enabled.**
116
-
Change the **id** from **all_users** to the ObjectID of the group from the Azure AD portal.
117
-
118
-
You need to PATCH the entire includeTarget to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **displayAppInformationRequiredState**.
119
-
120
-
```json
121
-
//Copy paste the below in the Request body section as shown below.
122
-
//Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
145
-
146
-
147
-
#### Example of error when enabling additional context for multiple groups
148
-
149
-
The PATCH request will fail with 400 Bad Request and the error will contain the following message:
150
-
151
-
`Persistance of policy failed with error: You cannot enable multiple targets for feature 'Require Display App Information'. Choose only one of the following includeTargets to enable: aede0efe-c1b4-40dc-8ae7-2c402f23e312,aede0efe-c1b4-40dc-8ae7-2c402f23e317.`
152
-
153
-
### Test the end-user experience
154
-
Add the test user account to the Authenticator app. The account **doesn't** need to be enabled for phone sign-in.
155
-
156
-
See the end-user experience of an Authenticator multifactor authentication push notification with additional context by signing into aka.ms/MFAsetup.
157
-
158
-
### Turn off additional context
159
-
160
-
To turn off additional context, you'll need to PATCH remove **displayAppInformationRequiredState** from **enabled** to **disabled**/**default**.
To enable additional context in the Azure AD portal, complete the following steps:
184
-
185
-
1. Sign in to the [Azure portal](https://portal.azure.com) using an account with *global administrator* permissions.
186
-
1. Search for and select **Azure Active Directory**, then choose **Security** from the menu on the left-hand side.
187
-
1. Under the **Manage** menu header, select **Authentication methods** > **Policies**.
188
-
1. From the list of available authentication methods, select **Microsoft Authenticator**.
189
-
190
-
191
-
192
-
1. Select the target users, select the three dots on the right, and choose **Configure**.
193
-
194
-
48
+
:::image type="content" border="true" source="./media/how-to-mfa-additional-context/enable-app-name.png" alt-text="Screenshot of how to enable application name.":::
49
+
50
+
Then do the same for **Show geographic location in push and passwordless notifications (Preview)**.
51
+
52
+
:::image type="content" border="true" source="./media/how-to-mfa-additional-context/enable-geolocation.png" alt-text="Screenshot of how to enable geographic location.":::
195
53
196
-
1. Select the **Authentication mode**, and then for **Show additional context in notifications (Preview)**, select **Enable**, and then select **Done**.
54
+
You can configure application name and geographic location separately. For example, the following policy enables application name and geographic location for all users but excludes the Operations group from seeing geographic location.
197
55
198
-
56
+
:::image type="content" border="true" source="./media/how-to-mfa-additional-context/exclude.png" alt-text="Screenshot of how to enable application name and geographic location separately.":::
199
57
200
58
## Known issues
201
59
202
-
Additional context isn't supported for Network Policy Server (NPS).
60
+
Additional context is not supported for Network Policy Server (NPS) or Active Directory Federation Services (AD FS).
0 commit comments