Microsoft Authenticator shows application name and geographic location
The Microsoft Authenticator authentication method should have the Show application name (displayAppInformationRequiredState) and Show geographic location (displayLocationInformationRequiredState) feature settings enabled. This adds context to push and passwordless notifications so users can detect and reject fraudulent approval requests.
ProwlerRisk
Without application-name and location context, users approving MFA push notifications cannot tell a legitimate sign-in from an attacker-initiated one, making the tenant more vulnerable to MFA fatigue and prompt-bombing attacks.
Run this check with Prowler
Run in Prowler Cloudprowler m365 --checks entra_authentication_method_authenticator_show_contextRecommendation
Enable the application-name and geographic-location context settings for Microsoft Authenticator so users receive additional information to identify and reject fraudulent sign-in approvals.
Remediation
Other
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
class entra_authentication_method_authenticator_show_context(Check):
"""Check if Microsoft Authenticator shows application name and geographic location.
The Microsoft Authenticator method should be enabled with the
``displayAppInformationRequiredState`` and
``displayLocationInformationRequiredState`` feature settings enabled, so users see
the app name and sign-in location context in push and passwordless notifications.
- PASS: Both application name and geographic location context are shown.
- FAIL: Application name and/or geographic location context is not shown.
"""
def execute(self) -> List[CheckReportM365]:
"""Execute the Microsoft Authenticator show context check.
Verifies that the Microsoft Authenticator method is enabled and configured to
display both the application name and the geographic location of the sign-in in
push and passwordless notifications.
Returns:
List[CheckReportM365]: A list with a single report describing whether
Microsoft Authenticator shows application name and geographic location
context, or an empty list when the authentication methods policy settings
are not available.
"""
findings = []
settings = entra_client.authentication_methods_policy_settings
if not settings:
return findings
report = CheckReportM365(
metadata=self.metadata(),
resource=settings,
resource_name="Microsoft Authenticator Method",
resource_id="microsoftAuthenticator",
)
report.status = "FAIL"
report.status_extended = (
"Microsoft Authenticator does not show both application name and "
"geographic location in notifications."
)
if (
settings.authenticator_state == "enabled"
and settings.authenticator_display_app_information_state == "enabled"
and settings.authenticator_display_location_information_state == "enabled"
):
report.status = "PASS"
report.status_extended = (
"Microsoft Authenticator shows application name and geographic "
"location in notifications."
)
findings.append(report)
return findings