Multi-factor authentication is an essential element of identity and access management, but it is not fail-proof as attackers are increasingly employing social engineering tactics to bypass MFA controls. As a way to enhance the security of MFA, Microsoft is enforcing “number matching” for all users of its Microsoft Authenticator app.
Previously, the process flow for Microsoft Authenticator just displayed a prompt in the app when the user tried to log into an application. The user tapped the prompt on the secondary device to authorize the transaction. Number matching adds another step by forcing users to have the secondary device and see the login screen on the primary device. Instead of just tapping the prompt, users will now have to enter a number that is displayed on the application’s login screen. A person logging into Office 365, for example, would see a message on the original login screen with a numeric code. The person would enter that code into the Authenticator app on their secondary device to approve the transaction. There is no way to opt out of entering the code.
“Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator,” Microsoft said in a support article. “We will remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting May 8, 2023.”
Attacks Are More Prevalent
Number matching was originally introduced in Microsoft Authenticator as an optional feature in October 2022 after attackers started spamming users with MFA push notification requests. Users were granting access to the attackers just to get the spam notifications to stop, or by mistake. Number matching is designed to help users avoid accidentally approving false authentication attempts. MFA fatigue – overwhelming users with MFA push notifications requests – has “become more prevalent,” according to Microsoft, who observed almost 41,000 Azure Active Directory Protection sessions with multiple failed MFA attempts in August 2022, compared with 32,442 a year earlier. There were 382,000 attacksemploying this tactic in 2022, Microsoft said.
It was also recently used in attacks against Uber, Microsoft, and Okta.
Number matching with Authenticator will be used for actions such as password resets, registration, and access to Active Directory. Users will also see additional context, such as the name of the application and the location of the login attempt, to prevent accidental approvals. The idea is that users have to cannot accept a login attempt if they are not in front of the login screen at that time.
How to Enable Number Matching
While number matching was enabled by default for Microsoft Azure in February, users will see that some services will start using this feature before others. Microsoft recommends enabling number match in advance to “ensure consistent behavior.” Administrators can enable the setting by navigating to Security – Authentication methods – Microsoft Authenticator in the Azure portal.
- On the Enable and Target tab, click Yes and All users to enable the policy for everyone or add selected users and groups. The Authentication mode for these users and groups should be either Any or Push.
- On the Configure tab for Require number matching for push notifications, change Status to Enabled, choose who to include or exclude from number matching, and click Save.
Administrators can also limit the number of MFA authentication request allowed per user and lock the accounts or alert the security team when the number is exceeded.
Users should upgrade to the latest version of Microsoft Authenticator on their mobile devices.
Number matching does not work for wearables such as Apple Watch or other Android devices. Users will have to key in the number via the mobile device, instead.
