{"id":4276,"date":"2022-08-03T11:14:53","date_gmt":"2022-08-03T18:14:53","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4276"},"modified":"2022-08-04T07:04:53","modified_gmt":"2022-08-04T14:04:53","slug":"4276","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4276","title":{"rendered":"How to Use Number Matching in Multifactor Authentication (MFA) Notifications &#8211; Authentication Methods Policy"},"content":{"rendered":"\n<p>This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security.<\/p>\n\n\n\n<p>Number matching is a key security upgrade to traditional second-factor notifications in the Authenticator app that will be enabled by default for all tenants a few months after general availability (GA).<br>We highly recommend enabling number matching in the near-term for improved sign-in security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"prerequisites\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#prerequisites\"><\/a>Prerequisites<\/h2>\n\n\n\n<p>Your organization will need to enable Authenticator (traditional second factor) push notifications for some users or groups using the new Authentication Methods Policy API. If your organization is using ADFS adapter or NPS extensions, please upgrade to the latest versions for a consistent experience.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"number-matching\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#number-matching\"><\/a>Number matching<\/h2>\n\n\n\n<p>Number matching can be targeted to only a single group, which can be dynamic or nested. On-premises synchronized security groups and cloud-only security groups are supported for the Authentication Method Policy.<\/p>\n\n\n\n<p>Number matching is available for the following scenarios. When enabled, all scenarios support number matching.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/tutorial-enable-azure-mfa\">Multifactor authentication<\/a><\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/howto-sspr-deployment\">Self-service password reset<\/a><\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/howto-registration-mfa-sspr-combined\">Combined SSPR and MFA registration during Authenticator app set up<\/a><\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/howto-mfaserver-adfs-windows-server\">AD FS adapter<\/a><\/li><li><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/howto-mfa-nps-extension\">NPS extension<\/a><\/li><\/ul>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>For passwordless users, enabling or disabling number matching has no impact because it&#8217;s already part of the passwordless experience.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"multifactor-authentication\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#multifactor-authentication\"><\/a>Multifactor authentication<\/h3>\n\n\n\n<p>When a user responds to an MFA push notification using the Authenticator app, they will be presented with a number. They need to type that number into the app to complete the approval.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/media\/howto-authentication-passwordless-phone\/phone-sign-in-microsoft-authenticator-app.png\" alt=\"Screenshot of user entering a number match.\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"sspr\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#sspr\"><\/a>SSPR<\/h3>\n\n\n\n<p>During self-service password reset, the Authenticator app notification will show a number that the user will need to type in their Authenticator app notification. This number will only be seen to users who have been enabled for number matching.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"combined-registration\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#combined-registration\"><\/a>Combined registration<\/h3>\n\n\n\n<p>When a user is goes through combined registration to set up the Authenticator app, the user is asked to approve a notification as part of adding the account. For users who are enabled for number matching, this notification will show a number that they need to type in their Authenticator app notification.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ad-fs-adapter\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#ad-fs-adapter\"><\/a>AD FS adapter<\/h3>\n\n\n\n<p>The AD FS adapter supports number matching after installing an update. Earlier versions of Windows Server don&#8217;t support number matching. On earlier versions, users will continue to see the&nbsp;<strong>Approve<\/strong>\/<strong>Deny<\/strong>&nbsp;experience and won&#8217;t see number matching until you upgrade.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Version<\/th><th>Update<\/th><\/tr><\/thead><tbody><tr><td>Windows Server 2022<\/td><td><a href=\"https:\/\/support.microsoft.com\/topic\/october-26-2021-kb5006745-os-build-20348-320-preview-8ff9319a-19e7-40c7-bbd1-cd70fcca066c\">October 26, 2021\u2014KB5006745 (OS Build 20348.320) Preview<\/a><\/td><\/tr><tr><td>Windows Server 2019<\/td><td><a href=\"https:\/\/support.microsoft.com\/topic\/october-19-2021-kb5006744-os-build-17763-2268-preview-e043a8a3-901b-4190-bb6b-f5a4137411c0\">October 19, 2021\u2014KB5006744 (OS Build 17763.2268) Preview<\/a><\/td><\/tr><tr><td>Windows Server 2016<\/td><td><a href=\"https:\/\/support.microsoft.com\/topic\/october-12-2021-kb5006669-os-build-14393-4704-bcc95546-0768-49ae-bec9-240cc59df384\">October 12, 2021\u2014KB5006669 (OS Build 14393.4704)<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"nps-extension\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#nps-extension\"><\/a>NPS extension<\/h3>\n\n\n\n<p>Make sure you run the latest version of the&nbsp;<a href=\"https:\/\/www.microsoft.com\/download\/details.aspx?id=54688\">NPS extension<\/a>. NPS extension versions beginning with 1.0.1.40 support number matching.<\/p>\n\n\n\n<p>Because the NPS extension can&#8217;t show a number, a user who is enabled for number matching will still be prompted to&nbsp;<strong>Approve<\/strong>\/<strong>Deny<\/strong>. However, you can create a registry key that overrides push notifications to ask a user to enter a One-Time Passcode (OTP). The user must have an OTP authentication method registered to see this behavior. Common OTP authentication methods include the OTP available in the Authenticator app, other software tokens, and so on.<\/p>\n\n\n\n<p>If the user doesn&#8217;t have an OTP method registered, they will continue to get the&nbsp;<strong>Approve<\/strong>\/<strong>Deny<\/strong>&nbsp;experience. A user with number matching disabled will always see the&nbsp;<strong>Approve<\/strong>\/<strong>Deny<\/strong>&nbsp;experience.<\/p>\n\n\n\n<p>To create the registry key that overrides push notifications:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>On the NPS Server, open the Registry Editor.<\/li><li>Navigate to HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\AzureMfa.<\/li><li>Set the following Key Value Pair: Key: OVERRIDE_NUMBER_MATCHING_WITH_OTP Value = TRUE<\/li><li>Restart the NPS Service.<\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"policy-schema-changes\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#policy-schema-changes\"><\/a>Policy schema changes<\/h3>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>In Graph Explorer, ensure you&#8217;ve consented to the&nbsp;<strong>Policy.Read.All<\/strong>&nbsp;and&nbsp;<strong>Policy.ReadWrite.AuthenticationMethod<\/strong>&nbsp;permissions.<\/p>\n\n\n\n<p>Identify your single target group for the schema configuration. Then use the following API endpoint to change the numberMatchingRequiredState property to&nbsp;<strong>enabled<\/strong>:<\/p>\n\n\n\n<p><a href=\"https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator\">https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"microsoftauthenticatorauthenticationmethodconfiguration-properties\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#microsoftauthenticatorauthenticationmethodconfiguration-properties\"><\/a>MicrosoftAuthenticatorAuthenticationMethodConfiguration properties<\/h4>\n\n\n\n<p><strong>PROPERTIES<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Property<\/th><th>Type<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>id<\/td><td>String<\/td><td>The authentication method policy identifier.<\/td><\/tr><tr><td>state<\/td><td>authenticationMethodState<\/td><td>Possible values are:&nbsp;<strong>enabled<\/strong><br><strong>disabled<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>RELATIONSHIPS<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Relationship<\/th><th>Type<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>includeTargets<\/td><td><a href=\"https:\/\/docs.microsoft.com\/en-us\/graph\/api\/resources\/passwordlessmicrosoftauthenticatorauthenticationmethodtarget\">microsoftAuthenticatorAuthenticationMethodTarget<\/a><\/td><td><\/td><\/tr><tr><td>collection<\/td><td>A collection of users or groups who are enabled to use the authentication method.<\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"microsoftauthenticator-includetarget-properties\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#microsoftauthenticator-includetarget-properties\"><\/a>MicrosoftAuthenticator includeTarget properties<\/h4>\n\n\n\n<p><strong>PROPERTIES<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Property<\/th><th>Type<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>authenticationMode<\/td><td>String<\/td><td>Possible values are:<br><strong>any<\/strong>: Both passwordless phone sign-in and traditional second factor notifications are allowed.<br><strong>deviceBasedPush<\/strong>: Only passwordless phone sign-in notifications are allowed.<br><strong>push<\/strong>: Only traditional second factor push notifications are allowed.<\/td><\/tr><tr><td>id<\/td><td>String<\/td><td>Object ID of an Azure AD user or group.<\/td><\/tr><tr><td>targetType<\/td><td>authenticationMethodTargetType<\/td><td>Possible values are:&nbsp;<strong>user<\/strong>,&nbsp;<strong>group<\/strong>.<br>Please note: You will be able to only set one group or user for number matching.<\/td><\/tr><tr><td>numberMatchingRequiredState<\/td><td>advancedConfigState<\/td><td>Possible values are:<br><strong>enabled<\/strong>&nbsp;explicitly enables the feature for the selected group.<br><strong>disabled<\/strong>&nbsp;explicitly disables the feature for the selected group.<br><strong>default<\/strong>&nbsp;allows Azure AD to manage whether the feature is enabled or not for the selected group.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>Number matching can only be enabled for a single group.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"example-of-how-to-enable-number-matching-for-all-users\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#example-of-how-to-enable-number-matching-for-all-users\"><\/a>Example of how to enable number matching for all users<\/h4>\n\n\n\n<p>You will need to change the&nbsp;<strong>numberMatchingRequiredState<\/strong>&nbsp;from&nbsp;<strong>default<\/strong>&nbsp;to&nbsp;<strong>enabled<\/strong>.<\/p>\n\n\n\n<p>Note that the value of Authentication Mode can be either&nbsp;<strong>any<\/strong>&nbsp;or&nbsp;<strong>push<\/strong>, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use&nbsp;<strong>any<\/strong>, but if you do not want to allow passwordless, use&nbsp;<strong>push<\/strong>.<\/p>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p>For passwordless users, enabling or disabling number matching has no impact because it&#8217;s already part of the passwordless experience.<\/p>\n\n\n\n<p>You might need to patch the entire includeTarget to prevent overwriting any previous configuration. In that case, do a GET first, update only the relevant fields, and then PATCH. The following example only shows the update to the&nbsp;<strong>numberMatchingRequiredState<\/strong>.<\/p>\n\n\n\n<p>JSONCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/Retrieve your existing policy via a GET. \n\/\/Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.\n\/\/Change the Query to PATCH and Run query\n \n{\n    \"@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodConfigurations\/$entity\",\n    \"@odata.type\": \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\",\n    \"id\": \"MicrosoftAuthenticator\",\n    \"state\": \"enabled\",\n    \"includeTargets@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodsPolicy\/authenticationMethodConfigurations('MicrosoftAuthenticator')\/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\/includeTargets\",\n    \"includeTargets\": &#91;\n        {\n            \"targetType\": \"group\",\n            \"id\": \"all_users\",\n            \"authenticationMode\": \"any\",\n            \"displayAppInformationRequiredState\": \"enabled\",\n            \"numberMatchingRequiredState\": \"enabled\"\n        }\n    ]\n}\n \n<\/code><\/pre>\n\n\n\n<p>To confirm this has applied, please run the GET request below using the endpoint below. GET &#8211;&nbsp;<a href=\"https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator\">https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"example-of-how-to-enable-number-matching-for-a-single-group\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#example-of-how-to-enable-number-matching-for-a-single-group\"><\/a>Example of how to enable number matching for a single group<\/h4>\n\n\n\n<p>We will need to change the&nbsp;<strong>numberMatchingRequiredState<\/strong>&nbsp;value from&nbsp;<strong>default<\/strong>&nbsp;to&nbsp;<strong>enabled.<\/strong>&nbsp;You will need to change the&nbsp;<strong>id<\/strong>&nbsp;from&nbsp;<strong>all_users<\/strong>&nbsp;to the ObjectID of the group from the Azure AD portal.<\/p>\n\n\n\n<p>You need to PATCH the entire includeTarget to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the&nbsp;<strong>numberMatchingRequiredState<\/strong>.<\/p>\n\n\n\n<p>JSONCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/Copy paste the below in the Request body section as shown below.\n\/\/Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.\n\/\/Change query to PATCH and run query\n{\n    \"@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodConfigurations\/$entity\",\n    \"@odata.type\": \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\",\n    \"id\": \"MicrosoftAuthenticator\",\n    \"state\": \"enabled\",\n    \"includeTargets@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodsPolicy\/authenticationMethodConfigurations('MicrosoftAuthenticator')\/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\/includeTargets\",\n    \"includeTargets\": &#91;\n        {\n            \"targetType\": \"group\",\n            \"id\": \"1ca44590-e896-4dbe-98ed-b140b1e7a53a\",\n            \"authenticationMode\": \"any\",\n            \"displayAppInformationRequiredState\": \"enabled\",\n            \"numberMatchingRequiredState\": \"enabled\"\n        }\n    ]\n}\n<\/code><\/pre>\n\n\n\n<p>To verify, RUN GET again and verify the ObjectID GET&nbsp;<a href=\"https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator\">https:\/\/graph.microsoft.com\/beta\/authenticationMethodsPolicy\/authenticationMethodConfigurations\/MicrosoftAuthenticator<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"example-of-error-when-enabling-number-matching-for-multiple-groups\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#example-of-error-when-enabling-number-matching-for-multiple-groups\"><\/a>Example of error when enabling number matching for multiple groups<\/h4>\n\n\n\n<p>The PATCH request will fail with 400 Bad Request and the error will contain the following message:<\/p>\n\n\n\n<p><code>Persistance of policy failed with error: You cannot enable multiple targets for feature 'Require Number Matching'. Choose only one of the following includeTargets to enable: aede0efe-c1b4-40dc-8ae7-2c402f23e312,aede0efe-c1b4-40dc-8ae7-2c402f23e317.<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"test-the-end-user-experience\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#test-the-end-user-experience\"><\/a>Test the end user experience<\/h3>\n\n\n\n<p>Add the test user account to the Authenticator app. The account does&nbsp;<strong>not<\/strong>&nbsp;need to be enabled for phone sign-in.<\/p>\n\n\n\n<p>See the end user experience of an Authenticator MFA push notification with number matching by signing into aka.ms\/MFAsetup.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"turn-off-number-matching\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#turn-off-number-matching\"><\/a>Turn off number matching<\/h3>\n\n\n\n<p>To turn number matching off, you will need to PATCH remove&nbsp;<strong>numberMatchingRequiredState<\/strong>&nbsp;from&nbsp;<strong>enabled<\/strong>&nbsp;to&nbsp;<strong>disabled<\/strong>\/<strong>default<\/strong>.<\/p>\n\n\n\n<p>JSONCopy<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodConfigurations\/$entity\",\n    \"@odata.type\": \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\",\n    \"id\": \"MicrosoftAuthenticator\",\n    \"state\": \"enabled\",\n    \"includeTargets@odata.context\": \"https:\/\/graph.microsoft.com\/beta\/$metadata#authenticationMethodsPolicy\/authenticationMethodConfigurations('MicrosoftAuthenticator')\/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\/includeTargets\",\n    \"includeTargets\": &#91;\n        {\n            \"targetType\": \"group\",\n            \"id\": \"all_users\",\n            \"authenticationMode\": \"any\",\n            \"displayAppInformationRequiredState\": \"enabled\",\n            \"numberMatchingRequiredState\": \"default\"\n        }\n    ]\n}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"enable-number-matching-in-the-portal\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#enable-number-matching-in-the-portal\"><\/a>Enable number matching in the portal<\/h2>\n\n\n\n<p>To enable number matching in the Azure AD portal, complete the following steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>In the Azure AD portal, click&nbsp;<strong>Security<\/strong>&nbsp;&gt;&nbsp;<strong>Authentication methods<\/strong>&nbsp;&gt;&nbsp;<strong>Microsoft Authenticator<\/strong>.<\/li><li>Select the target users, click the three dots on the right, and click&nbsp;<strong>Configure<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/media\/howto-authentication-passwordless-phone\/configure.png\" alt=\"Screenshot of configuring number match.\"><\/li><li>Select the&nbsp;<strong>Authentication mode<\/strong>, and then for&nbsp;<strong>Require number matching (Preview)<\/strong>, click&nbsp;<strong>Enable<\/strong>, and then click&nbsp;<strong>Done<\/strong>.<img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/media\/howto-authentication-passwordless-phone\/enable-number-matching.png\" alt=\"Screenshot of enabling number match.\"><\/li><\/ol>\n\n\n\n<p>&nbsp;Note<\/p>\n\n\n\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/roles\/delegate-by-task#multi-factor-authentication\">Least privileged role in Azure Active Directory &#8211; Multifactor authentication<\/a><\/p>\n\n\n\n<p>Number matching is not supported for Apple Watch notifications. Apple Watch need to use their phone to approve notifications when number matching is enabled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"next-steps\"><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match#next-steps\"><\/a>Next steps<\/h2>\n\n\n\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/concept-authentication-authenticator-app\">Authentication methods in Azure Active Directory<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Ref: https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/how-to-mfa-number-match<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. Number matching is a key security upgrade to traditional second-factor notifications in the Authenticator app that will be enabled by default for all tenants a few months after general availability (GA).We highly recommend enabling number matching in <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=4276\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[10,18],"tags":[1265],"class_list":["post-4276","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-microsoft-office","tag-use-number-matching-in-multifactor-authentication"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4276"}],"version-history":[{"count":2,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4276\/revisions"}],"predecessor-version":[{"id":4278,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4276\/revisions\/4278"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}