Understanding the Microsoft Authenticator not securely configured risk

BarracudaONE displays this risk when it detects, through Microsoft Entra ID, that Microsoft Authenticator is enabled but not configured to show users the application name and geographic location for sign-in requests.

These settings give users important context before they approve an MFA prompt. Without them, users may approve a sign-in request without knowing which application is requesting access or whether the sign-in location is expected.

Microsoft Authenticator is not securely configured when it is enabled without login context settings, such as application name and geographic location, for authentication prompts. This configuration makes it easier for attackers to trick users into approving sign-in requests they did not initiate.

This risk is aligned with CISA SCuBA Microsoft Entra ID baseline policy MS.AAD.3.3v2, which requires Microsoft Authenticator to show login context information when the method is enabled.

Microsoft Authenticator helps protect accounts from password-only compromise, but it is less effective when users do not have enough information to evaluate a sign-in prompt. If a prompt does not show the application name or geographic location, users may not be able to tell whether the request is legitimate.

Attackers can exploit this gap. After stealing or guessing a password, an attacker repeatedly triggers sign-in prompts until the user approves one by mistake or out of fatigue.

Showing the application name and location gives users context they can use to reject suspicious prompts before unauthorized access occurs. Enabling these settings improves protection against social engineering and helps users make safer approval decisions.

BarracudaONE checks the Microsoft Authenticator authentication method policy in Microsoft Entra ID. This risk is displayed when Microsoft Authenticator policy data is available from Microsoft Entra ID and any of the following are true:

• Microsoft Authenticator is disabled or set to default (not enabled for all users).

• Microsoft Authenticator is enabled but application name is not enabled.

• Microsoft Authenticator is enabled but geographic location is not enabled.

BarracudaONE evaluates this as a tenant-wide configuration risk. This risk does not show a user evidence list because it is based on the Microsoft Authenticator policy configuration rather than individual user activity.

Resolving this risk involves configuring Microsoft Authenticator in Microsoft Entra ID so that all users see application name and geographic location context when they receive sign-in prompts.

1. In the left navigation menu, select Home.

2. In the Risks section, do one of the following:

   • Select the Microsoft Authenticator not securely configured risk.

   • Click View risks, then, in the left menu, click the Microsoft Authenticator not securely configured risk.

3. Review the risk details and confirm that Microsoft Authenticator is missing one or more secure login context settings.

4. In Microsoft Entra ID, go to the Microsoft Authenticator authentication method policy.

5. Set Microsoft Authenticator to Enabled and target it to All users.

6. On the Configure tab, enable both application name and geographic location for all users.

7. Set Allow use of Microsoft Authenticator OTP to No.

When this criteria is met, the risk auto-resolves after BarracudaONE syncs the updated Microsoft Entra ID configuration.

If Microsoft Authenticator is later reconfigured so that application name or geographic location is not enabled, the risk returns.

Securely configuring Microsoft Authenticator provides:

• Reduced risk of MFA prompt abuse—Users can identify prompts that may have been triggered by an attacker.

• Stronger protection against phishing—Application and location context make it harder to trick users into approving fraudulent sign-ins.

• More consistent authentication security—All users receive the same contextual information when approving sign-ins.

• Better alignment with CISA guidance—The configuration supports the MS.AAD.3.3v2 baseline requirement for Microsoft Authenticator login context.