rules/findings/entra/identity_protection/eid-microsoft-authenticator-lack-mfa-fatigue-protection.json
|
{
"provider": "EntraID", "serviceType": "Identity Protection", "serviceName": "Microsoft Entra ID", "displayName": "Ensure Microsoft Authenticator is configured to protect against MFA fatigue", "description": "Microsoft has released additional settings to enhance the configuration of the Microsoft Authenticator application. These settings provide additional information and context to users who receive MFA passwordless and push requests, such as geographic location the request came from, the requesting application and requiring a number match.\r\n\t\t\t\t Ensure the following are \u0060Enabled\u0060.\r\n\r\n\t\t\t\t * \u0060Require number matching for push notifications\u0060\r\n\t\t\t\t * \u0060Show application name in push and passwordless notifications\u0060\r\n\t\t\t\t * \u0060Show geographic location in push and passwordless notifications\u0060", "rationale": "As the use of strong authentication has become more widespread, attackers have started to exploit the tendency of users to experience \u0060MFA fatigue\u0060. This occurs when users are repeatedly asked to provide additional forms of identification, leading them to eventually approve requests without fully verifying the source. To counteract this, number matching can be employed to ensure the security of the authentication process. With this method, users are prompted to confirm a number displayed on their original device and enter it into the device being used for MFA. Additionally, other information such as geolocation and application details are displayed to enhance the end user\u0027s awareness. Among these 3 options, number matching provides the strongest net security gain.", "impact": "Additional interaction will be required by end users using number matching as opposed to simply pressing \u0022Approve\u0022 for login attempts.", "remediation": { "text": "\n\t\t\t1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com. \n\t\t\t2. Click to expand \u0060Protection \u003E Authentication methods\u0060 select \u0060Policies\u0060. \n\t\t\t3. Select \u0060Microsoft Authenticator\u0060\n\t\t\t4. Under \u0060Enable and Target\u0060 ensure the setting is set to \u0060Enable\u0060.\n\t\t\t5. Select \u0060Configure\u0060\n\t\t\t6. Set the following Microsoft Authenticator settings: \n\t\t\t\t* \u0060Require number matching for push notifications Status\u0060 is set to \u0060Enabled\u0060, Target \u0060All users\u0060\n\t\t\t\t* \u0060Show application name in push and passwordless notifications\u0060 is set to \u0060Enabled\u0060, Target \u0060All users\u0060\n\t\t\t\t* \u0060Show geographic location in push and passwordless notifications\u0060 is set to \u0060Enabled\u0060, Target \u0060All users\u0060\n\t\t\t\t*Note*: Valid groups such as break glass accounts can be excluded per organization policy.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-default-enablement", "https://techcommunity.microsoft.com/t5/microsoft-entra-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677", "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "7.0.0", "reference": "5.2.3.1", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_auth_method_policies", "subPath": "authenticationMethodConfigurations", "selectCondition": { "conditions": [ [ "id", "eq", "MicrosoftAuthenticator" ] ] }, "query": [ { "filter": [ { "conditions": [ [ "featureSettings.displayAppInformationRequiredState.state", "eq", "enabled" ], [ "featureSettings.displayAppInformationRequiredState.includeTarget.id", "eq", "all_users" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "featureSettings.numberMatchingRequiredState.state", "eq", "enabled" ], [ "featureSettings.numberMatchingRequiredState.includeTarget.id", "eq", "all_users" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "featureSettings.displayLocationInformationRequiredState.state", "eq", "enabled" ], [ "featureSettings.displayLocationInformationRequiredState.includeTarget.id", "eq", "all_users" ] ], "operator": "and" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Authentication Method", "state": "State", "featureSettings.displayAppInformationRequiredState.state": "Display Information", "featureSettings.numberMatchingRequiredState.includeTarget.id": "NumberMatchingTarget", "featureSettings.displayLocationInformationRequiredState.state": "Display Location Information", "featureSettings.displayLocationInformationRequiredState.includeTarget.id": "displayLocationInformationTarget" }, "expandObject": null }, "table": null, "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { "id": "Authentication Method", "state": "State", "featureSettings.displayAppInformationRequiredState.state": "Display Information", "featureSettings.numberMatchingRequiredState.includeTarget.id": "NumberMatchingTarget", "featureSettings.displayLocationInformationRequiredState.state": "Display Location Information", "featureSettings.displayLocationInformationRequiredState.includeTarget.id": "displayLocationInformationTarget" }, "expandObject": null }, "status": { "keyName": "", "message": "Microsoft Authenticator was not configured to protect against MFA fatigue", "defaultMessage": null }, "properties": { "resourceName": "Id", "resourceId": null, "resourceType": "EntraAuthMethodPolicy" }, "onlyStatus": false } }, "idSuffix": "aad_mfa_fatigue_not_configured", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "entraid_1146" } |