[onaworkcomputer]

Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.

[petilon]

No, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.

[EwanToo]

For Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows

[judge2020]

Administrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/auth...

[onaworkcomputer]

Oof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.

[larrybud]

Sorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.

[JoBrad]

Same here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.

[scoopertrooper]

... you can still do the code based flow if you want...

[mistrial9]

I want to see what the execs use, not the code monkey "requirements"

[adolph]

Depends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny.

If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.

[notesinthefield]

Duo also works this way