This one change will have no impact on your users if they already have MFA in place, but if they already chose the passwordless option on their mobile device they would be enabled for no-password sign-in with this change (you could customise the “Authentication Methods” policy for Microsoft Authenticator to turn this off, but as going passwordless is a user decision there is no prompts or change to behaviour just by enabling “all users” for the Microsoft Authenticator policy at this time. By default this is turned off (impacting no users) and we are going to turn it on for everyone. Here you will see a number of rows, and we are interested in the Microsoft Authenticator row. To check your Authentication Methods visit (AAD Admin Portal at > Security > Authentication Methods city wide, not street or house level) and another new feature called number match. It is this control that we can update to include the municipal location (i.e. The “Authentication Methods” page in Azure AD is a control that allows you to roll out Push MFA and/or Passwordless authentication to some or all of your users. In the above, the user is asked to click Approve (or Deny) with no prior context to who and where the authentication is coming from. So before we start, this is what we would see on the mobile device with just Azure AD MFA push notifications (Android view) Azure AD MFA Default Notifications It also requires that MFA is enabled for a set or all users via the Azure AD portal and the “Authentication Methods” page.

This update to Azure AD requires the use of Push Notifications and therefore requires the use of the Microsoft Authenticator app.

This feature rolled out to Azure AD in mid November 2021 in preview – so use in non-production tenants initially until you are happy with the changes. This Azure AD feature is something that a number of other Multi-Factor Authentication providers have already implemented – that of showing the location of the user login (and the app in use) on the MFA prompt.

Microsoft mfa login