Skip to content

Commit cd4374c

Browse files
committed
added feedback from Mayur
1 parent 3bc3b1b commit cd4374c

File tree

2 files changed

+12
-5
lines changed

2 files changed

+12
-5
lines changed

articles/active-directory/authentication/concept-authentication-default-enablement.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ Number matching is a good example of protection for an authentication method tha
3737
As MFA fatigue attacks rise, number matching becomes more critical to sign-in security. As a result, Microsoft will change the default behavior for push notifications in Microsoft Authenticator.
3838

3939
>[!NOTE]
40-
>Azure AD will make number matching in push notifications the default behavior for all users in every tenant at the end of February 2023.
40+
>Number matching will begin to be enabled for all users of Microsoft Authenticator starting February 27, 2023.
4141
4242
<!---Add link to Mayur Blog post here--->
4343

@@ -47,7 +47,7 @@ In addition to configuring Authentication methods policy settings to be either *
4747

4848
The option to let Azure AD manage the setting is a convenient way for an organization to allow Microsoft to enable or disable a feature by default. Organizations can more easily improve their security posture by trusting Microsoft to manage when a feature should be enabled by default. By configuring a setting as **Microsoft managed** (named *default* in Graph APIs), IT admins can trust Microsoft to enable a security feature they haven't explicitly disabled.
4949

50-
For example, an admin can enable [location and application name](how-to-mfa-number-match.md) in push notifications to give users more context when they approve MFA requests by with Microsoft Authenticator. The additional context can also be explicitly disabled, or set as **Microsoft managed**. Today, the **Microsoft managed** configuration for location and application name is **Disabled**, which effectively disables it for any environment where an admin chooses to let Azure AD manage the setting.
50+
For example, an admin can enable [location and application name](how-to-mfa-number-match.md) in push notifications to give users more context when they approve MFA requests with Microsoft Authenticator. The additional context can also be explicitly disabled, or set as **Microsoft managed**. Today, the **Microsoft managed** configuration for location and application name is **Disabled**, which effectively disables the option for any environment where an admin chooses to let Azure AD manage the setting.
5151

5252
As the security threat landscape changes over time, Microsoft may change the **Microsoft managed** configuration for location and application name to **Enabled**. For customers who want to rely upon Microsoft to improve their security posture, setting security features to **Microsoft managed** is an easy way stay ahead of security threats. They can trust Microsoft to determine the best way to configure security settings based on the current threat landscape.
5353

articles/active-directory/authentication/how-to-mfa-number-match.md

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to use number matching in MFA notifications
44
ms.service: active-directory
55
ms.subservice: authentication
66
ms.topic: conceptual
7-
ms.date: 10/07/2022
7+
ms.date: 10/20/2022
88
ms.author: justinha
99
author: mjsantani
1010
ms.collection: M365-identity-device-management
@@ -16,7 +16,7 @@ ms.collection: M365-identity-device-management
1616
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security.
1717

1818
>[!NOTE]
19-
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will be enabled by default for all tenants at the end of February 2023.<br>
19+
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will begin to be enabled by default for all users starting February 27, 2023.<br>
2020
>We highly recommend enabling number matching in the near-term for improved sign-in security.
2121
2222
## Prerequisites
@@ -26,7 +26,7 @@ This topic covers how to enable number matching in Microsoft Authenticator push
2626
>[!NOTE]
2727
>The policy schema for Microsoft Graph APIs has been improved. The older policy schema is now deprecated. Make sure you use the new schema to help prevent errors.
2828
29-
- If your organization is using ADFS adapter or NPS extensions, upgrade to the latest versions for a consistent experience.
29+
- If your organization is using AD FS adapter or NPS extensions, upgrade to the latest versions for a consistent experience.
3030

3131
## Number matching
3232

@@ -350,6 +350,13 @@ To enable number matching in the Azure AD portal, complete the following steps:
350350

351351
:::image type="content" border="true" source="./media/how-to-mfa-number-match/number-match.png" alt-text="Screenshot of how to enable number matching.":::
352352

353+
354+
## FAQs
355+
356+
### When will my tenant see number match if I do not use the Azure portal or Graph API to roll out the change?
357+
358+
Number match will be enabled for all users of Microsoft Authenticator app after February 27, 2023. Relevant services will begin deploying these changes after February 27, 2023 and users will start to see number match in approval requests. As services deploy, some may see number match while others don't. To ensure consistent behavior for all your users, we highly recommend you use the Azure portal or Graph API to roll out number match for all Microsoft Authenticator users.
359+
353360
## Next steps
354361

355362
[Authentication methods in Azure Active Directory](concept-authentication-authenticator-app.md)

0 commit comments

Comments
 (0)