Does Duo have plans to support Number Matching MFA prompts?

[StoopidMonkey]

We are starting to deploy some Azure resources and we are evaluating whether we should keep Duo MFA or switch to Microsoft Authenticator. While Duo feels more user-friendly, there is one feature Microsoft has that I wish Duo did: Number Matching. Basically, for first-time or risky logins it displays a number on the web browser’s login screen which the user has to enter in their MFA app. This guarantees that they don’t accidentally approve an unrequested MFA prompt from muscle memory.

[Amy2]

Hi @StoopidMonkey, thanks for your interest in Duo and for sharing your question here. While I can’t share details at this time, the Duo team is actively exploring ways to reduce push fraud, and there is an existing feature request for this functionality with a lot of customer support. I encourage you to ask your Duo sales representative for more information, as they may be able to share more details with you than I can in our public forum.

[vob]

I am interested on this topic also.

[Amy2]

Thanks for noting your interest here @alevere! Welcome to the Duo Community. As soon as we have an update to share publicly on this topic, we will announce it in the forum. I’ll make sure to follow up on this thread as well.

[Mel Chandler]

I’m also interested in this feature.

[CJ_Ky]

Any update on this feature? Definitely interested in implementing number matching.

[DuoKristina · Accepted solution]

Take a look at our public preview of verified Duo Push; available now to Duo MFA, Access, and Beyond plan customers.

Verified Duo Push authentication method in Duo Policy documentation

[RajeevK]

@DuoKristina Are there any plans to allow the verification number length to be configuired? Rather than 6 digits, 2?

[Joshua_Terry]

Hi Rajeev,

Duo decided to start by providing the maximum level of security by requiring a six digit code. We believe two digits with only 100 permutations allows for an unacceptable level of risk for the majority of our customers.

We appreciate the feedback here and are evaluating allowing configurability as to the # of digits shown to allow for different risk tolerances. If you would like to be part of that development reach out to your Duo representative and we would love to show you what we’re working on.

[DuoKristina]

Are there any plans to allow the verification number length to be configuired? Rather than 6 digits, 2?

For anyone who finds this post later, the number of digits for push verification is now configurable from 3-6 digits since November 2022.

Edited to fix a typo that previously said Duo supported 2-6 digit push verification codes.

[david.loewy.appian]

My workplace recently implemented verification codes for our SSO. I’m sharing a minor gripe here. When I open the MFA alert on my Android device, it does not automatically open a keypad for number entry – I have to tap into the empty number box for the keypad to open. It would be great if a future version would open a keypad automatically and save me this extra click! Thank you.

[DuoKristina]

As a Pixel user I agree and pester my colleagues about Android feature parity to our iOS app all the time.

[leonharda]

Are there plans to implement this into the Windows logon application? I have a similar story to OP, where we have Authenticator and Duo running side by side protecting different systems. MFA fatigue mitigation steps have made us disable Duo Push in a lot of cases, but this feature would let us re-enable it for those cases.

[kehankins]

Hello there!

Yes, there are plans to bring Verified Push into WinLogon. You will likely see Passwordless OS Login become available in the August - October 2023 timeframe as a fatigue mitigator. The step-up Verified Push itself will be in the research phases during this period, with the intent to release soonafter. If you’d like to hear more about this in detail, please feel free to reach out to your contacts here at Duo and we’d happy to chat more!