What this check looks at
Checks that Microsoft Authenticator on companion applications (Authenticator Lite, MFA approvals inside Outlook mobile) is set to disabled, rather than enabled or left to Microsoft.
Authenticator Lite puts part of Microsoft Authenticator inside companion apps, today Outlook for iOS and Android: people can approve sign-ins, or read a one-time code, there instead of in the Authenticator app. The setting is Microsoft Authenticator on companion applications, under the Authenticator method; left as Microsoft-managed, Microsoft has turned it on.
This check applies when Microsoft Authenticator is turned on as a sign-in method. It passes only when Authenticator on companion applications is set to Disabled, and fails when it is enabled or left to Microsoft. The setting is only returned by Microsoft Graph beta, so when that read fails the check says it could not check, never that it is off.
Authenticator Lite has fewer protections than the full app: it shows no app name or location on an approval request, and holds no passkeys, and an approval prompt inside a mail app, among messages, is easier to tap without a second look.
Why it matters
Authenticator Lite lets people approve sign-ins inside Outlook mobile instead of the Authenticator app. It offers fewer protections than the full app, and an approval prompt inside a mail app is easier to tap without thinking. Keeping MFA in the Authenticator app, managed and registered on purpose, keeps one consistent, stronger method.
At a 30-person practice, staff answer approval prompts in Outlook on their phones between emails. An attacker with a phished password sends repeated sign-in attempts during a busy morning and one is approved by reflex. With approvals kept in the Authenticator app, which shows the app asking and where the sign-in comes from, that reflex is much harder to trigger.
CIS Microsoft 365 Foundations Benchmark v7.0.0 5.2.3.10 asks for Microsoft Authenticator on companion applications to be disabled, so that MFA stays in one managed app. NIST CSF PR.AA-03 supports it.
How to fix it
Where: Entra admin centre → Entra ID → Authentication methods → Microsoft Authenticator
Before you start
- Check the authentication methods activity report for people whose only Authenticator method is Authenticator Lite, and have them register the Authenticator app or a passkey first.
Step by step
- Find who relies on it. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > Activity and look at registered methods: anyone whose only Authenticator registration is in Outlook needs the Microsoft Authenticator app, or a passkey, before you switch it off.
- Open the Authenticator settings. Go to Entra ID > Authentication methods > Policies, select Microsoft Authenticator, then the Configure tab.
- Disable it on companion applications. Under Microsoft Authenticator on companion applications, set Status to Disabled (not Microsoft managed), and select Save.
- Confirm the change. Sign in to a test account whose Authenticator was set up in Outlook mobile: Outlook should no longer offer to approve the sign-in. The finding clears at the next assessment.
What users will notice
Sign-ins can no longer be approved inside Outlook mobile; people approve them in the Microsoft Authenticator app.
How to confirm it worked
Entra admin centre, Authentication methods, Microsoft Authenticator, Configure: Microsoft Authenticator on companion applications shows Disabled.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 5.2.3.10 Ensure Microsoft Authenticator on companion applications is disabled |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Microsoft Authenticator Lite (Microsoft Learn)