Self-service password reset (SSPR) with Microsoft Authenticator will require number matching when using Microsoft Authenticator. For more information about how to set up MFA, see Tutorial: Secure user sign-in events with Azure AD Multi-Factor Authentication. They need to type that number into the app to complete the approval. When a user responds to an MFA push notification using the Authenticator app, they'll be presented with a number. Wearable device users need to use their phone to approve notifications when number matching is enabled.

Number matching isn't supported for push notifications for Apple Watch or Android wearable devices. Combined SSPR and MFA registration during Authenticator app set up.When enabled, all scenarios support number matching. Number matching is available for the following scenarios.

On-premises synchronized security groups and cloud-only security groups are supported for the Authentication methods policy. Number matching can be targeted to only a single group, which can be dynamic or nested. If your organization is using AD FS adapter or NPS extensions, upgrade to the latest versions for a consistent experience. You can edit the Authentication methods policy by using the Azure portal or Microsoft Graph API. Your organization needs to enable Microsoft Authenticator (traditional second factor) push notifications for some users or groups by using the new Authentication methods policy. To ensure consistent behavior for all users, we highly recommend you enable number match for Microsoft Authenticator push notifications in advance. As services deploy, some may see number match while others don't. Relevant services will begin deploying these changes after and users will start to see number match in approval requests.

We highly recommend enabling number matching in the near term for improved sign-in security. We will remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting May 8, 2023. Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator.

2 factor authentication microsoft