Number Matching
Number matching is a push MFA design in which the sign-in screen shows a short number and the user must type that number into the authenticator app to approve, instead of tapping a plain Approve button. It stops blind approval of prompts the user did not start, which is the mechanism behind MFA fatigue and push bombing (MITRE ATT&CK T1621).
Microsoft documents that number matching is now enabled for all Microsoft Authenticator push notifications, including MFA, self-service password reset and the AD FS and NPS integrations, and it is not supported on wearable devices. The limit is important: number matching is still phishable. A real-time phishing proxy shows the victim the genuine number from the real sign-in page, and the victim types it in. NIST SP 800-63B-4 says authenticators that involve manual entry of an output "SHALL NOT be considered phishing-resistant", so number matching is an interim control on the way to passkeys or security keys. The 2022 Uber incident in the Identity Breach Database is the case usually cited for why plain push approval was not enough.
See also: MFA fatigue and push bombing, phishable MFA, phishing-resistant MFA, Microsoft Authenticator, MFA matrix
Related on Start with Identity
- GlossaryMFA Device
An MFA device is the physical thing a user has (a phone running an authenticator app, a hardware security key, a smart card, or an OTP token) that supplies the
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossarySmishing
Smishing, short for SMS phishing, is phishing delivered by text message: the attacker sends an SMS (or a chat message on a messaging app) that pushes the target
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin