The settingWhat we hold this to
CreativeTechs minimum
SMS, Voice call and Email OTP all state = disabled. Microsoft Authenticator state = enabled, with number matching and additional context ON for all users.
Benchmark position
EIDSCA.AM01 — Authenticator state recommended 'enabled'. CIS M365 5.2.3.5 (L1) — weak authentication methods disabled. CISA MS.AAD.3.5. Our minimum matches all three.
Where we differ, and why
READ THIS BEFORE ACTING on a 'disabled' result. Two systems can serve an Authenticator push: the LEGACY MFA service settings, and the modern Authentication methods policy. While the tenant sits in migrationInProgress, the legacy settings still govern what users can actually use — so Authenticator works perfectly for everyone while the modern policy's MicrosoftAuthenticator object reads 'disabled'. That is exactly the CreativeTechs tenant today (EIDSCA.AM01 disabled; AM02–AM10 all skipped for 'method not enabled'; migration state migrationInProgress). The danger is the switchover: the moment migration is marked Complete, the modern policy becomes authoritative, and if Authenticator is still disabled there, every user relying on it loses their method at once. Enable it in the Authentication methods policy FIRST — it is additive and changes nothing for users while legacy is still in charge.
Where the switch is
Entra admin centre → Protection → Authentication methods → Policies. Set each method's state, then Microsoft Authenticator → Configure → Require number matching = Enabled, Show application name and geographic location = Enabled.
How to verify
Graph: /policies/authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator') → state eq 'enabled'
Same path for 'Sms', 'Voice', 'Email' → state eq 'disabled'- Why it matters
- SIM swap and OTP-relay phishing kits defeat all three. Authenticator push with number matching and additional context is the realistic floor.
- How we check
- Maester CISA.MS.AAD.3.5, EIDSCA.AM01, CIS.M365.5.2.3.5.
- Fix — M365
- Entra → Authentication methods → disable SMS, Voice and Email OTP; enable Microsoft Authenticator with number matching and location context.
- Fix — Google
- Admin → Security → 2SV → allow any method except verification codes via text or call.
- User notices
- Anyone on SMS re-enrols on an app. That's the part needing a runway, even though the control itself is silent.
- Expected pushback
- “I don't want work stuff on my phone.” A hardware key, or enrolment on a company device. Both cheaper than the incident.