CISA.MS.AAD.3.3 - If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Overview

If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Rationale: This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises.

Remediation action:

If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

1. In Entra ID, click Security > Authentication Methods > Microsoft Authenticator.
2. Click the Configure tab.
3. For Allow use of Microsoft Authenticator OTP select No.
4. Under Show application name in push and passwordless notifications select Status > Enabled and Target > Include > All users.
5. Under Show geographic location in push and passwordless notifications select Status > Enabled and Target > Include > All users.
6. Select Save.

Related links

• CISA Strong Authentication & Secure Registration - MS.AAD.3.3v2
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.3.3
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1110 Brute Force, T1621 Multi-Factor Authentication Request Generation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.3
Criticality	SHALL
Upstream requirement	MS.AAD.3.3v2
Supports controls	cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2), nist-800-53-r5:IA-5c, nist-800-53-r5:IA-5g, nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(13)
PowerShell test	Test-MtCisaAuthenticatorContext
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.3.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.3.md