4 ms·
Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticat
by onaworkcomputer 5y ago
Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.
- petilon 5y agoNo, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.
- onaworkcomputer 5y agoOof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.
- scoopertrooper 5y ago... you can still do the code based flow if you want...
- mistrial9 5y agoI want to see what the execs use, not the code monkey "requirements"
- EwanToo 5y agoFor Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows
- larrybud 5y agoSorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.
- JoBrad 5y agoSame here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.
- judge2020 5y agoAdministrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://docs.microsoft.com/en-us/azure/active-directory/auth...
- adolph 5y agoDepends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny. If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.
- notesinthefield 5y agoDuo also works this way