M365 Roundup, November 2022: Number Matching Is Coming for Every Authenticator User
TL;DR
- Beginning February 27, 2023, Microsoft enables number matching by default for all Microsoft Authenticator users, a direct counter to MFA fatigue attacks.
- After the change, users on Authenticator versions that do not support number matching will fail authentication until the app is updated.
- NPS extension versions from 1.2.2131.2 will prompt for a One-Time Passcode instead of number match, since the extension cannot display a number.
- Teams users can now permanently delete 1:1, group, and meeting chats for themselves without affecting other participants.
- SharePoint tenant URL rename is generally available for organizations with fewer than 10,000 total sites, including OneDrive sites.
November 2022's roundup has one item that outranks everything else: Microsoft has set the date for enabling Authenticator number matching by default, and the ripple effects touch ADFS, NPS, SSPR, and even the Apple Watch. Beyond that, Teams Premium picks up its virtual appointments dashboard, users gain the ability to delete their own chats, SharePoint tenant URL rename reaches general availability, and a 16.67% SMB promo runs through mid-2023. Here is every MSP-relevant Microsoft announcement from November, with dates.
The big one: number matching becomes the Authenticator default on February 27, 2023
Beginning February 27, 2023, Microsoft starts enabling number matching by default for all Microsoft Authenticator users. To prevent accidental approvals, admins can require users to enter a number displayed on the sign-in screen when approving an MFA request in the Authenticator app. This is critical protection against MFA fatigue attacks, which are on the rise.
Admins can also reduce accidental approvals by showing users additional context in Authenticator notifications, selectively enabling:
- Application context: show users which application they are signing into.
- Geographic location context: show users their sign-in location based on the IP address of the device they are signing into.
How number matching behaves in different scenarios after February 27, 2023:
- Authentication flows will require users to do number match when using the Microsoft Authenticator app. If a user is on a version of the app that does not support number match, their authentication will fail. Make sure users upgrade to the latest version of Microsoft Authenticator (App Store and Google Play Store) before the date.
- Self Service Password Reset (SSPR) and combined registration flows will also require number match when users authenticate with the Authenticator app.
- The ADFS adapter requires number matching only on versions of Windows Server that support it. On earlier versions, users continue to see the Approve/Deny experience until you upgrade to:
- Windows Server 2022: October 26, 2021 update, KB5006745 (OS Build 20348.320)
- Windows Server 2019: October 19, 2021 update, KB5006744 (OS Build 17763.2268)
- Windows Server 2016: October 12, 2021 update, KB5006669 (OS Build 14393.4704)
- NPS extension versions beginning 1.2.2131.2 will require number matching after February 27, 2023. Because the NPS extension cannot show a number, the user is asked to enter a One-Time Passcode (OTP) instead, which requires an OTP authentication method (the Authenticator app, software tokens, and so on) registered for the user. Users without an OTP method keep the Approve/Deny experience. A registry key can override this behavior and keep Approve/Deny; see the number matching documentation.
- Apple Watch remains unsupported for number matching. Microsoft recommends uninstalling the Authenticator Apple Watch app, since approvals must happen on the phone.
End-user rollout documentation: end-user rollout templates and materials (zip) (opens in new tab).
Teams: Premium virtual appointments and self-service chat deletion
Advanced Virtual Appointments arrive with Teams Premium
The Virtual Appointments app in Microsoft Teams includes a dashboard that gives a quick view of an employee's schedule as integrated with Bookings. Teams Premium extends it with a snapshot of the appointment queue, a summary of appointment analytics, and options to manage appointments.
Details on the Advanced Virtual Appointments features are here (opens in new tab). The feature is part of the new Teams Premium license: Introducing Microsoft Teams Premium, the better way to meet | Microsoft 365 Blog (opens in new tab).
Timing: preview rollout begins early December 2022, completing by mid-December 2022. Standard release begins early February 2023, completing by mid-February 2023.
Users can delete their own chats
Users can now delete 1:1 chats, group chats, and meeting chats they participate in. The deletion is permanent but applies only to the user who deletes; other participants and their conversation history are unaffected.
Timing: early December 2022, completing rollout by mid-December 2022.
SharePoint: tenant URL rename reaches general availability
As announced at Ignite 2022, renaming your SharePoint domain URL is now generally available to organizations with fewer than 10,000 total sites, a count that includes both OneDrive and SharePoint sites. If a rename is on your list, review the public documentation (opens in new tab) before starting.
Licensing: 16.67% SMB promos run November 14, 2022 through June 30, 2023
The Microsoft 365 SMB New Customer, Upsell, and CSP legacy to CSP new commerce renewal promotion gives partners a pitch for consolidating vendors or upgrading security and productivity posture with more premium products. The promotion provides a 16.67 percent discount to customers who are new to Microsoft 365, existing customers upgrading to a more premium product, or customers on legacy CSP migrating to the new commerce experience, in each case starting with a low-risk monthly subscription on any eligible product.
Promo FAQ: https://aka.ms/FY23DMWLOfferFAQ (opens in new tab)
Timing: offers are valid from November 14, 2022 to June 30, 2023.
Defaults change. Your tenants should keep up.
Every month Microsoft moves a setting you signed off on months ago. CloudCapsule rechecks 250+ controls per tenant in about 60 seconds, so update waves never turn into quiet drift.
Run a free assessment
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
