'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure Microsoft Authenticator Number Matching for Specific Groups
Question details
The user wants to apply Microsoft Authenticator number matching policies to a specific group, but the setting appears globally enforced and cannot be scoped.
- Product
- Microsoft Entra ID / Microsoft Authenticator
- Device & OS
- not provided
- Scenario
- Configuring MFA authentication method policies for organizational security.
- Observed behavior
- The number-matching setting cannot be scoped to a selected group and applies to all users across the organization.
Ensure you have Global Administrator or Authentication Policy Administrator privileges in the Microsoft Entra admin center before reviewing or modifying security policies.
Verify Global Enforcement of Number Matching
Understand that number matching is a mandatory security feature deployed globally by Microsoft and cannot be scoped to specific groups.
Microsoft has made number matching a default and mandatory security feature for Microsoft Authenticator push notifications to prevent MFA fatigue attacks.
Because this is a globally enforced security enhancement, the setting to enable or disable it cannot be scoped to specific Azure AD (Entra ID) groups. Even if you apply the base Authenticator policy to a selected group, the number matching requirement remains globally active for any user utilizing the app.
Log in to the Microsoft Entra admin center using your administrator credentials.
Go to Protection > Authentication methods > Policies in the left-hand navigation menu.
Click on the Microsoft Authenticator policy to review the targeted groups and configuration settings.
Check the 'Configure' tab. You will notice that while you can scope the overall Authenticator policy to specific groups, the 'Require number matching for push notifications' feature is enabled globally and cannot be toggled per group.
Boost Organizational Productivity with WPS Office
While you manage your organization's IT security and authentication policies, streamline your daily workflow with WPS Office. It provides a lightweight, highly compatible, and cost-effective alternative to Microsoft Office for your teams.
- 1. Download WPS Office: Visit the official WPS website and click the free download button.
- 2. Run the installer: Open the downloaded setup file and follow the on-screen instructions to install the suite.
- 3. Open and work: Launch WPS Office, open your existing Microsoft Office files seamlessly, and enjoy uninterrupted productivity.
Frequently Asked Questions
Why can't I disable number matching for specific users?
Microsoft enforces number matching globally for all users utilizing Microsoft Authenticator push notifications to mitigate MFA fatigue (spamming) attacks. It cannot be disabled for individual users or groups for security reasons.
Does the Authenticator policy group targeting apply to other settings?
Yes, you can still scope the overall use of Microsoft Authenticator to specific groups, as well as configure other features like location context or application context, provided they are not globally enforced by Microsoft.
How does number matching affect the user login experience?
When a user signs in, the login screen displays a two-digit number. The user must open the Microsoft Authenticator app on their mobile device, type that specific number into the prompt, and tap Approve to complete the authentication process.
