EIDSCA.AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.
| ID | EIDSCA.AM02 |
| Severity | Medium |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Low |
| MITRE ATT&CK | T1566.002 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Defines if users can use the OTP code generated by the Authenticator App.
CISA MS.AAD.3.3v2 recommends disabling Microsoft Authenticator OTP. We recommend using this method only if no stronger MFA option is available, or if it is needed for specific restore scenarios. Make sure you have configured authentication strength to require stronger and phishing-resistant authentication methods, in order to enforce stronger authentication than OTP in all other scenarios.
Test script
Section titled “Test script”https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator').isSoftwareOathEnabled -eq 'false'Remediation action
Section titled “Remediation action”Microsoft Learn - Enable OTP for Authenticator App
Related links
Section titled “Related links”- Open in Graph Explorer
- microsoftAuthenticatorAuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn
- View in Microsoft Entra admin center
Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.