Carnival Corporation

Ed Moore

Identity Security Steward

For companies that are currently using the Azure authenticator application, you may want to understand the change that Microsoft will be making on February 27^th that will impact you and your end users.  The change is going to be mainly for user experience and will impact all users.

Microsoft is changing the way that the push notification is sent to the end users using their authenticator application.  It will be rolling out call numbers matching for authenticator applications.  This is not something that you or your company will be able to opt out of.  This change is being made globally.

There is no technical reason to panic that we have found so far.  Again, the change is only impacting the user experience.  The user will no longer just get a push notification to approve or deny the MFA challenge that is sent to the cell phone.  Now, the user will see a number appear on their workstation, tablet, or cell phone.  In the example below on the left represents the workstation and shows the number 83.  The end user must enter this number into the authenticator application on their cell phone which is represented on the right side of the picture below. 

Image is from Microsoft’s announcement for the number matching communication in the link below.

Once the end user matches both numbers, then the user has passed the MFA challenge and they will be allowed into the application.  Again, it is just different than the experience that they had previously so you will need to work on communication of the change to your end users.

Why is Microsoft making this change?  Microsoft is using this feature to prevent the MFA fatigue or MFA bombing attacks as a deterrent. 

Our testing has not shown any issues.  Again, it is just a change to the way that it has worked previously.  The one thing that you need to communicate to the end user is that they need to read the prompts on the authenticator application on their cell phones properly.  This is especially true when they are using their phones to view something that requires MFA and the authenticator application is on that same cell phone. 

“Microsoft is changing the way that the push notification is sent to the end users using their authenticator application.  It will be rolling out call numbers matching for authenticator applications.”

There will be a prompt on the bottom of the number matching message on their cell phone to show the first screen again so that you can get the number.  The end user will just have two to three seconds to see the number before it takes them back to the authenticator matching screen on their cell phone.

You can test for the change before the 27^th as well.  You can go into the Azure console and then change the settings for the authenticator application.  There are three options that you turn on now to control when this change goes out to your population of end users. Microsoft will override what you have here now by turning on these options on the 27^th.

Hopefully this information helps to prepare you for the change ahead.  Want to know more, here is the link to the Microsoft announcement for more detailed information.  Thank you for your time.