We want to shut down MFA push bombing

Push bombing works as long as users tap Approve blindly. Number matching in Microsoft Authenticator asks for a two-digit code back, so you cannot approve by mistake. Microsoft has made this the default for all tenants.

Try this first

1. 1In the Entra portal go to Protection, Authentication methods, and pick Microsoft Authenticator. Under Configure, enable Show application name and Show geographic location, and confirm 'Require number matching for push notifications' is Enabled for All users.
2. 2Verify nobody still sees the old Approve / Deny flow. A test account on an unused device confirms it quickly.
3. 3Disable SMS and voice call as methods for accounts that do not depend on them. Both are weaker than Authenticator with number matching.
4. 4For admins: enforce FIDO2 keys or passkey through an Authentication Strength inside a Conditional Access policy. Push is fine for users, not for Global Admin.
5. 5Communicate the change once before rollout, otherwise you get a week of tickets from people who do not notice the digit.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.