Skip to content
MitoMito Docs

CISA.MS.AAD.3.3: If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.
ID CISA.MS.AAD.3.3
Severity Medium
Suite CISA SCuBA baselines
Product Entra ID
Feature Authentication methods
Security area Authentication
Resource type Tenant
User impact of fixing Medium
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.3.3 (SHALL)
Framework controls cisa-scuba:MS.AAD.3.3
nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accounts
nist-800-53-r5:IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts
nist-800-53-r5:IA-5c Authenticator Management
nist-800-53-r5:IA-5g Authenticator Management
nist-800-53-r5:IA-2(8) Identification and Authentication (Organizational Users) | Access to Accounts — Replay Resistant
nist-800-53-r5:IA-2(13) Identification and Authentication (Organizational Users) | Out-of-band Authentication
MITRE ATT&CK T1110, T1621
Reads from Microsoft Graph
Licence needed AAD_PREMIUM

What this checks and how to fix it

Section titled “What this checks and how to fix it”

If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.

Rationale: This policy helps protect the tenant when Microsoft Authenticator is used by showing user context information, which helps reduce MFA phishing compromises.

Remediation action:

Section titled “Remediation action:”

If Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

  1. In Entra ID, click Security > Authentication Methods > Microsoft Authenticator.
  2. Click the Configure tab.
  3. For Allow use of Microsoft Authenticator OTP select No.
  4. Under Show application name in push and passwordless notifications select Status > Enabled and Target > Include > All users.
  5. Under Show geographic location in push and passwordless notifications select Status > Enabled and Target > Include > All users.
  6. Select Save.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.