What number matching is and is not
With classic Authenticator push, the user sees Approve or Deny. With number matching, the number from the sign-in screen must be entered in the app. That ties the prompt to that one sign-in — not to a random push someone approves in a rush.
Number matching is not a substitute for MFA, not antivirus, and not training. It strengthens Authenticator-based MFA. SMS or a phone call sit outside it; for an SME, Authenticator with number matching is usually the clear standard once MFA is required.
Why an SME should enable it
A sensible moment is often when one or more of these apply:
- MFA is already on for staff — and Authenticator is the primary method.
- You want to reduce MFA fatigue — blind approvals when many push notifications arrive.
- Conditional Access or security defaults already require MFA — number matching fits next to that.
- Break-glass accounts are documented separately — so a stricter MFA experience does not lock the tenant during an outage.
Do not wait for an incident. Number matching is a small tenant change with a large effect once MFA already runs — see also alert policies for signals around suspicious sign-ins.
Break-glass accounts and Conditional Access
A stricter MFA experience means: document how break-glass / emergency accounts stay outside the normal Authenticator flow (or are secured differently on purpose), and how Conditional Access keeps requiring MFA without excluding everyone at once. Without that agreement, “number matching on” feels like sudden friction — and then the policy gets rolled back.
Name who may re-register Authenticator, what a user should do on an unexpected prompt (deny, report), and when Floor ICT escalates. Tie this to who may turn MFA off for one account and who manages break-glass accounts.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: turn number matching on for Microsoft Authenticator; confirm MFA stays required for the agreed groups; and give a short explanation of what staff see on screen. We check whether older Authenticator apps or exceptions block the rollout, unless you deliberately want to keep them.
You still decide: whether Authenticator is the default method, how you document break-glass accounts, whether a short internal note to staff is needed, and whether a report may become a Floor ICT ticket. Essential, Advanced or Elite say nothing about number matching; that is tenant configuration next to the MSP package. Number matching works best next to MFA that is already on, clear Conditional Access, and documented break-glass accounts.
More depth
Checklist for SME directors
1) Confirm MFA is on for staff. 2) Choose Authenticator as the primary method. 3) Have Floor ICT enable number matching. 4) Document break-glass accounts and re-registration. 5) Tell staff briefly: “type the number from the screen in the app”. 6) Review after two weeks for unnecessary exceptions — not everything at once.
Number matching versus Approve-only
Approve-only is faster, but vulnerable to MFA fatigue. Number matching asks for one digit from that sign-in’s context. For an SME that extra second is usually acceptable once MFA is required — see turn on MFA.
Licences and expectations
Number matching belongs with Microsoft Authenticator in Entra ID / Microsoft 365 tenants where Authenticator push is already available. Floor ICT says at intake what your tenant can do without promising a large identity programme. No promises of “zero phishing” — yes to a working stricter MFA step with an owner.
Questions
Frequently asked questions
Is number matching the same as multifactor authentication?
No. Multifactor authentication is the broader requirement (password plus a second factor). Number matching is a stricter way to confirm Authenticator push: you type the number from the sign-in screen in the app.
Do we need to turn MFA off first to enable number matching?
No. Enable number matching after MFA works for staff. It is an improvement on Authenticator, not a replacement for the MFA rollout.
Does this also work with SMS as the second factor?
Number matching applies to Microsoft Authenticator prompts with a number. SMS or a phone call follow a different path. For an SME, Authenticator with number matching is usually the clear standard.
Does Floor ICT do this by default under Microsoft 365 management?
At intake or when Microsoft 365 is in scope, we propose number matching once MFA is on. Whether Authenticator is the default method and how break-glass accounts are handled remains yours. The MSP package says nothing about number matching; that is separate tenant configuration.