MFA & Verification Issues

Can IT Send On-Demand Microsoft Authenticator Push Notifications?

Steven Parker Oct 14, 2026 869 views

Question details

An IT administrator wants to know if there is a way to send an arbitrary, manual push notification via Microsoft Authenticator solely to verify that a user is in physical possession of their enrolled phone.

Can IT Send an On-Demand Microsoft Authenticator Push Notification?

Product: Microsoft Authenticator
Device & OS: not provided
Scenario: Verifying physical possession of a user's mobile device through an IT-initiated push notification.
Observed behavior: Administrators cannot find a native feature within Microsoft Entra ID or the Authenticator app to send unsolicited push notifications for identity possession checks.

Before you start

Ensure you have administrator access to the Microsoft Entra admin center and are familiar with your organization's multi-factor authentication (MFA) and conditional access policies.

Solution 1Recommended

Utilize Standard Microsoft Entra Authentication Workflows

Since arbitrary on-demand pushes are not natively supported, the best approach is to use standard Entra ID verification tools by prompting a normal authentication event.

Microsoft Authenticator does not provide a built-in feature for sending unsolicited push notifications purely to check phone possession. Attempting to force an on-demand prompt falls outside typical identity verification workflows and could contribute to MFA fatigue.

Instead of an arbitrary push, administrators should initiate a process that requires the user to authenticate naturally.

Revoke existing MFA sessions

Log in to the Microsoft Entra admin center, navigate to 'Users' > 'All users', select the specific user, and click 'Revoke MFA sessions' to clear their current trusted status.

Require re-authentication

Instruct the user to attempt a sign-in to a corporate resource (such as Office 365 or a company portal). This action will organically trigger a standard Microsoft Authenticator push notification.

Monitor sign-in logs

Go to 'Identity' > 'Monitoring & health' > 'Sign-in logs' in the Entra admin center to verify that the user successfully received and approved the MFA push notification on their device.

Scripting Alternatives: While not natively supported in the admin UI, some advanced IT setups may use PowerShell scripting combined with Microsoft Graph APIs to force token expirations, which effectively triggers an MFA prompt upon the next user action.

Solution 2

Consult Microsoft Q&A for Advanced Configurations

Engage with Microsoft identity engineers to explore custom workarounds or feature requests regarding Authenticator.

Free Microsoft Office alternative

Boost IT Productivity with WPS Office

While resolving complex identity management and Microsoft Authenticator configurations, ensure your IT team's day-to-day documentation workflows remain uninterrupted. WPS Office is a lightweight, highly compatible alternative to Microsoft Office that allows your organization to manage reports, scripts, and documentation for free.

1. Download the installer: Visit the official WPS Office website and click the download button for the free installation package.
2. Install WPS Office: Run the downloaded setup file and follow the on-screen instructions to quickly complete the installation.
3. Open and edit files: Launch WPS Office to instantly open your existing Microsoft Office documents without any formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight installation ensures fast deployment across corporate environmentsFamiliar user interface reduces training time for employees and IT staffBuilt-in PDF editing tools for comprehensive IT documentation and policy drafting

microsoft office alternative - wps office

Frequently Asked Questions

Can I use PowerShell to send an Authenticator push notification?

There is no direct official PowerShell cmdlet specifically designed to send an arbitrary push notification to Microsoft Authenticator. However, administrators can use PowerShell to revoke sessions or trigger a conditional access MFA requirement during a sign-in event.

How can I verify a user has their phone if I cannot send a custom push?

You can ask the user to sign into a secure company portal while you monitor the sign-in logs in Microsoft Entra ID. This standard process naturally triggers an MFA prompt which the user must approve with their device.

Why doesn't Microsoft support on-demand push notifications for admins?

Unsolicited push notifications can lead to MFA fatigue, a scenario where users approve prompts out of habit without verifying the source. This is a significant security risk, so standard workflows intentionally tie prompts directly to user-initiated sign-ins.

Where can I view if an Authenticator notification was approved?

Administrators can view authentication details and MFA approval status within the Microsoft Entra admin center by navigating to the Sign-in logs and checking the 'Authentication Details' tab for a specific user session.

Login & Account Issues