Guides / Authenticator number matching: approve sign-in not showing

Part of: Sign-in, password and MFA problems

Last reviewed 5 Oct 2026 · By Harry

Authenticator number matching: approve sign-in not showing

Microsoft Authenticator number matching prompt missing or approve sign-in not showing? App version, notification path, registration and Entra policy.

The browser shows a two-digit number and says to approve the sign-in in Microsoft Authenticator. The phone never shows the matching prompt — or it shows an old "Approve / Deny" without a number field. Users call this "MFA is broken". Number matching is now the normal Authenticator experience; when the prompt does not appear, work the phone and the registration before you touch Conditional Access.

Is Entra having an authentication incident?

Check Entra ID and Microsoft 365. If sign-in fails for many users across many phones and networks, and Service health names MFA / Authenticator, pause phone theatre. One user with a silent phone while colleagues approve happily is a desk fix.

Get them signed in now

1. Open Authenticator manually. The pending request with the number often sits inside the app when the banner notification never fired.
2. Use the one-time code. On the sign-in page choose I can't use my Microsoft Authenticator app right now / Sign in another way and enter the six-digit code from the account tile. Codes do not need push or number matching.
3. Other registered methods (SMS, call, FIDO2, TAP) if the tenant allows them.

Why number matching does not appear

• Notification blocked. Same causes as push failures: Focus mode, Android battery optimisation, iOS Background App Refresh, guest Wi-Fi captive portals. See Authenticator not getting notifications.
• Old app version. Number matching needs a current Microsoft Authenticator. Ancient builds may show legacy approve/deny or nothing useful after Microsoft enforces matching.
• Wrong account tile. Personal Microsoft accounts and work accounts both live in the app. The prompt lands on the work tile — users staring at a personal tile think nothing arrived.
• Stale registration after phone swap / backup restore. Work accounts often need re-registration; restored backups can leave a ghost device that Entra still pushes to.
• Clock drift. Extreme time skew confuses TOTP fallback and sometimes session timing; set date & time automatic.
• Multiple devices registered. Push may go to an old phone in a drawer. Remove stale devices in security info.

Admin checks in Entra

• Sign-in log → Authentication details. Was the push sent, timed out, denied, or interrupted? "Denied" means someone tapped No — treat as possible attack if the user did not.
• Authentication methods policy. Microsoft Authenticator enabled; number matching is standard for push. Confirm the user is in scope.
• Require re-register MFA and delete the stale Authenticator method for old hardware.
• Temporary Access Pass for lost-phone break-glass, then force fresh registration.
• Legacy per-user MFA vs Conditional Access quirks — prefer CA + Authentication methods policy; document which the tenant still uses.

Security: prompts the user did not start

If number-matching prompts appear without a sign-in the user began, someone has the password. Deny, reset password, revoke sessions, and hunt the sign-in log. That is not a notification bug.

When to escalate

Escalate to Microsoft when Authenticator push/number matching fails broadly, sign-in logs show delivery failures, and Entra status agrees. Include correlation IDs, UTC times and username samples. A single phone on Do Not Disturb is not a tenant incident.

Related status pages

• Microsoft Entra ID
• Microsoft 365
• Okta

Related guides

• Microsoft Authenticator not getting notifications: fixes
• Lost phone or new phone: Microsoft Authenticator recovery
• Microsoft 365 sign-in loop or 'More information required'

FAQ

Why am I not seeing the Authenticator number matching prompt?

Usually notifications are blocked, the app is outdated, the wrong account tile is open, or MFA needs re-registration after a phone change. Open the app directly and look for a pending request.

Can I sign in without number matching?

Yes if your organisation allows it: choose another sign-in method and use the six-digit Authenticator code, SMS, security key or Temporary Access Pass.

Number matching shows on the PC but my phone never asks

The push is not reaching that device. Fix notifications, update the app, remove stale devices, or re-register Authenticator.

Is missing number matching an Entra outage?

Only when many users on different networks fail and status/Service health agree. One silent phone is a local or registration issue.