Sign in

ARE NUMBER MATCHING STILL GOOD ENOUGH FOR MFA IN 2026??

Solvedidentitymfasecurity-awareness19 replies · 487 views · started
Reply
Accepted solution by Selin Castillo — plan recovery before rollout: at least two registered methods per user, a verified identity porcess at teh helpdesk, and temporary access…
  1. Milan Varga
    @milanv484

    so annoyed rn were a school district and use number matching for MFA today 🤦 After hearing about push-bombing attacks, Im wondering whether were as protected as we think. Users approve things without reading, and phishing kits proxy everything anyway. Whats a realistic next step that wont cause a helpdesk riot?

    we don't have a big security team... it's basically me and one colleague, plus a helpdesk that already handles a lot of password resets... whaetver we choose has to be supportbale by a small team, not just secure on paper.

    4
  2. Zora B.
    @pingwarden

    hmmm do ur users mostly have company phones or personal phones? ??

    0 4 helpful
  3. Selin Castillo
    @selinc595
    in reply to @pingwarden

    ugh. spent 3 hours on identity and im still not done, have u checked your matching settings? mine were reset after an update what am i doing wrong??

    2 2 helpful
  4. Kenji Sato
    @kenji_early

    wait is district even worth bothering with or should i just leave it. exact same thing happened to my brand new build last month

    0 2 helpful
  8. Kenji Sato
    @kenji_early

    hmmmm quick q wait does this also apply to matching? ??

    2 0 helpful
  10. Zora B.
    @pingwarden

    btw unrelated but anyone elses coffee machine also judging them today :)

    1 0 helpful
  11. Amara Reid
    @areid

    lol same thing happened to me pair MFA with conditional access: require compliant or managed devices for sensitive apps, block legacy authentication, and alert on many denied pushes in a short time.

    thinking

    0 2 helpful
  12. Sana N.
    @sana.novak

    Phishing-resistant methods (FIDO2 security keys, platform passkeys, certificate-based auth) bind authentication to teh real site, so a proxy phishing page cant relay it. Start with admins and finance, then expand. lmk how it goes

    0 1 helpful
  13. Maya Reid
    @mayar645

    SMS is better than no MFA, but it's vulnerable to SIM swapping and real-time phishing. Treat it as a fallback, not the primary method.

    1 0 helpful
  14. Maya Reid
    @mayar645

    oh ive been there lol have u checked your matching settings? 😂 mine were reset after an update hope that helps :)

    6 2 helpful
  15. Tess
    @tess_signal

    which version are you on? ?

    thinking

    17 0 helpful
  16. Kenji Sato
    @kenji_early

    been there man make a backup before u touch the BIOS, learned that the hard way fingers crossed 🤞

    3 0 helpful
  17. Cleo Adler
    @cleo_uplink

    number matching plus showing app and location in teh push prompt dramatically reduces blind approvals.. 😅 most major identity providers support it; enable it before considering anything more expensive.

    0 3 helpful
  19. Selin Castillo
    @selinc595
    Accepted solution

    plan recovery before rollout: at least two registered methods per user, a verified identity porcess at teh helpdesk, and temporary access passes instead of just disable MFA for a day.

    lol

    1 2 helpful
  20. Milan Varga
    @milanv484
    in reply to @selinc595

    @selinc595 decided to keep app-based MFA with number matching for most users and add conditional access, thanks for the realistic take.

    15 0 helpful

Reply to this topic

Sign in or create an account to reply.