Can Microsoft Authenticator Lite App and Named location based on GPS coordinates work together?

On May 26, 2023, Microsoft moved Microsoft Authenticator Lite App to General availability. Authenticator Lite was introduced to help organizations adopt alternative tool of authentication for users who had still not downloaded the full Microsoft Authenticator application for MFA, in an endeavor to enhance the security by moving from text message (SMS) and voice-based authentication. This is to ensure that every user sign-in is done using modern strong authentication. Authenticator Lite is embedded in Outlook client for iOS and Android platforms allowing users to request authentication and receive Time Based One Time Password (TOTP) codes.

The feature is currently in the state ‘Microsoft managed.’ until June 9 after which it will be turned on by default.

Which bring me us back to the topic of this blog. If you already have users registered for Microsoft Authenticator app, then you don't have to do anything and this post may not apply to you, however, if you are planning to use Authenticator Lite app in your organization then this post may just interest you.

I have been testing with Authenticator Lite app for various scenarios and one of such scenarios involved enforcing Conditional Access policies requiring MFA against a named GPS coordinated location. In addition to IP addresses, GPS coordinated location is another way to setup country based locations. It works by contacting the user's Microsoft Authenticator app every hour to collect the GPS location of the user's mobile device. The user receives a notification in the Microsoft Authenticator app and needs to open and grant location permissions. Every hour the user is accessing resources covered by the policy they need to approve a push notification from the app.

As of writing this blog, the Authenticator Lite app does not support GPS coordinated feature. So if you are using this feature in your conditional access policies as a named location under conditions, then you will need to have the users also register for Microsoft Authenticator app. Here is a quick way to get your users registered in no time.

To test this particular scenario, I carried out the following steps -

Enable Microsoft Authenticator Lite App

1. Navigate to Microsoft Entra Admin Center.

2. Go under Protect & secure and click on Authentication Methods.

3. Select Microsoft Authenticator and hit configure.

4. Enable Microsoft Authenticator on companion applications as shown below. Note: It is recommended to test this feature before enabling for all users. There are other scenarios where this feature is not working as expected which I am currently testing.

Once configured, the user will receive the MFA prompts through Outlook client app.

User's sign-in will reflect the new Authenticate Lite authentication method under Outlook app.

Configure Named location using GPS coordinates and Conditional Access Policy

1. Navigate to Microsoft Entra Admin Center.

2. Go under Protect & secure and click on Conditional Access.

3. Click on Named locations and configure the location using GPS coordinates as shown below.

4. On the Conditional Access blade, click on Policies.

5. Click on New policy and provide the necessary details. In my case, I am enabling MFA for a named location.

End user experience

If the user doesn't have Authenticator app installed and have the Authenticator Lite enabled, then with the CA policy enforced for named location leveraging GPS coordinates as a condition, user will not be allowed to access corporate resources and will receive the following message.

Azure sign-in logs will also suggest that.

If the user has the Microsoft Authenticator app installed and configured, then with the CA policy enforced for MFA with named location leveraging GPS coordinates as a condition will work normally. User will be required to allow the sharing of location.

This will also apply on other OS platforms if selected in the CA policy. In my case, the CA policy will apply on all device platforms.

Azure sign-in logs will show a successful sign-in and enforcement of the CA policy.

Conclusion

While Authenticator Lite app is an important security enhancement feature where users are still authenticating with SMS and voice methods, it does have its limitations. It is highly recommended to test the feature before Microsoft enables it as default after June 9. As for the GPS coordinates named location is concerned, it is worthy to note that users may receive prompts every hour letting them know that Azure AD is checking their location in the Authenticator app.