Enforce Number Matching MFA

[Knut]

Hi, I have enabled this for a few users - and it works good. However, when users change to "use login and password" for some apps, this authentication method is remembered after.

Is there a way to enforce users to always use Number Matching, meaning reverting the users mfa back from username/password?

[anyweb]

was this question related to Windows 365 or Azure AD ?

number matching will be the default method come february 2023, so how can users choose something else ?

Can I opt out of number matching?

Yes, currently you can disable number matching. We highly recommend that you enable number matching for all users in your tenant to protect yourself from MFA fatigue attacks. Microsoft will enable number matching for all tenants by Feb 27, 2023. After protection is enabled by default, users can't opt out of number matching in Microsoft Authenticator push notifications.

[Knut]

11 hours ago, anyweb said:

was this question related to Windows 365 or Azure AD ?

number matching will be the default method come february 2023, so how can users choose something else ?

Can I opt out of number matching?

Yes, currently you can disable number matching. We highly recommend that you enable number matching for all users in your tenant to protect yourself from MFA fatigue attacks. Microsoft will enable number matching for all tenants by Feb 27, 2023. After protection is enabled by default, users can't opt out of number matching in Microsoft Authenticator push notifications.

I know this will be the default method, but when users change the logon-option to username and password, it won't go back to Number Matching as default. The user have to manually change this back to Number Matching, and this can cause confusion. 

[anyweb]

where did they change the option, at the login to windows screen or somewhere else ?

[Knut]

When they log in to the app in azure, they can change the authentication method.

[anyweb]

i'm not sure which app you mean, but perhaps you mean this ? https://aka.ms/mfasetup

 

and in there the USER can change to whatever default method they want, this is a user setting and we cannot enforce it (that I am aware of)