Changes to multi-factor authentication (MFA) for Microsoft services

This year Microsoft introduced ‘number matching’ in the multi-factor authentication process when you access your Microsoft services. 

This is a great next step in security for your business. We’re seeing hackers use more advanced techniques to get around existing defences, including the current MFA function, so this a welcome change from Microsoft. 

Users may be used to simply clicking the ‘approve’ button in the current Authenticator app process. Now when a user receives an MFA notice while accessing their Microsoft services, they’ll be presented with a number on their screen (as per the screenshot above). Users will need to open their Authenticator app and type that number into the app to complete the approval. 

Here are some answers to frequently asked questions, provided by Microsoft.

1. Can I disable number matching in Microsoft Authenticator push notifications? No, Microsoft enables it by default for ALL tenants to protect users from MFA fatigue attacks. It is not configurable. 

2. Why is the number not displayed in the Microsoft Authenticator app on iOS/Android devices? Older versions of Microsoft Authenticator may need to be upgraded to the latest version. Download the latest versions from the App Store and Google Play Store.

3. Why is the user prompted to select from three numbers in the Microsoft Authenticator app? Older versions of Microsoft Authenticator may need to be upgraded to the latest version. Download the latest versions from the App Store and Google Play Store. 

4. Can I use number matching on Apple Watch? No, Apple Watch does not support number matching. You may need uninstall the Microsoft Authenticator Apple Watch app. 

5. Why can’t I view the number when signing from the Microsoft Authenticator app? Select I can’t see the number on the screen that hides the dialog for five seconds. 

To learn more about these changes please contact us or speak to your Grapevine account manager.