You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-authentication-default-enablement.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Number matching is a good example of protection for an authentication method tha
37
37
As MFA fatigue attacks rise, number matching becomes more critical to sign-in security. As a result, Microsoft will change the default behavior for push notifications in Microsoft Authenticator.
38
38
39
39
>[!NOTE]
40
-
>Azure AD will make number matching in push notifications the default behavior for all users in every tenant at the end of February 2023.
40
+
>Number matching will begin to be enabled for all users of Microsoft Authenticator starting February 27, 2023.
41
41
42
42
<!---Add link to Mayur Blog post here--->
43
43
@@ -47,7 +47,7 @@ In addition to configuring Authentication methods policy settings to be either *
47
47
48
48
The option to let Azure AD manage the setting is a convenient way for an organization to allow Microsoft to enable or disable a feature by default. Organizations can more easily improve their security posture by trusting Microsoft to manage when a feature should be enabled by default. By configuring a setting as **Microsoft managed** (named *default* in Graph APIs), IT admins can trust Microsoft to enable a security feature they haven't explicitly disabled.
49
49
50
-
For example, an admin can enable [location and application name](how-to-mfa-number-match.md) in push notifications to give users more context when they approve MFA requests by with Microsoft Authenticator. The additional context can also be explicitly disabled, or set as **Microsoft managed**. Today, the **Microsoft managed** configuration for location and application name is **Disabled**, which effectively disables it for any environment where an admin chooses to let Azure AD manage the setting.
50
+
For example, an admin can enable [location and application name](how-to-mfa-number-match.md) in push notifications to give users more context when they approve MFA requests with Microsoft Authenticator. The additional context can also be explicitly disabled, or set as **Microsoft managed**. Today, the **Microsoft managed** configuration for location and application name is **Disabled**, which effectively disables the option for any environment where an admin chooses to let Azure AD manage the setting.
51
51
52
52
As the security threat landscape changes over time, Microsoft may change the **Microsoft managed** configuration for location and application name to **Enabled**. For customers who want to rely upon Microsoft to improve their security posture, setting security features to **Microsoft managed** is an easy way stay ahead of security threats. They can trust Microsoft to determine the best way to configure security settings based on the current threat landscape.
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security.
17
17
18
18
>[!NOTE]
19
-
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will be enabled by default for all tenants at the end of February 2023.<br>
19
+
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will begin to be enabled by default for all users starting February 27, 2023.<br>
20
20
>We highly recommend enabling number matching in the near-term for improved sign-in security.
21
21
22
22
## Prerequisites
@@ -26,7 +26,7 @@ This topic covers how to enable number matching in Microsoft Authenticator push
26
26
>[!NOTE]
27
27
>The policy schema for Microsoft Graph APIs has been improved. The older policy schema is now deprecated. Make sure you use the new schema to help prevent errors.
28
28
29
-
- If your organization is using ADFS adapter or NPS extensions, upgrade to the latest versions for a consistent experience.
29
+
- If your organization is using AD FS adapter or NPS extensions, upgrade to the latest versions for a consistent experience.
30
30
31
31
## Number matching
32
32
@@ -350,6 +350,13 @@ To enable number matching in the Azure AD portal, complete the following steps:
350
350
351
351
:::image type="content" border="true" source="./media/how-to-mfa-number-match/number-match.png" alt-text="Screenshot of how to enable number matching.":::
352
352
353
+
354
+
## FAQs
355
+
356
+
### When will my tenant see number match if I do not use the Azure portal or Graph API to roll out the change?
357
+
358
+
Number match will be enabled for all users of Microsoft Authenticator app after February 27, 2023. Relevant services will begin deploying these changes after February 27, 2023 and users will start to see number match in approval requests. As services deploy, some may see number match while others don't. To ensure consistent behavior for all your users, we highly recommend you use the Azure portal or Graph API to roll out number match for all Microsoft Authenticator users.
359
+
353
360
## Next steps
354
361
355
362
[Authentication methods in Azure Active Directory](concept-authentication-authenticator-app.md)
0 commit comments