> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/push-notification.md).
# Push Notification
***
### Admin Setup
#### Configure the Authentication Journey
1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
2. Create a new journey or edit an existing one.
3. Under **Authentication Method**, select either:
* **Push Notification** - push-only, no password required.
* **Password & Push Notification** - password entered first, then push sent.
4. Assign the journey to the target user group or machine policy.
5. Save and publish the journey.
#### Enable Number Challenge
{% hint style="info" %}
Number Challenge requires Credential Provider v2.0.4.0 or later. Ensure the agent is updated before enabling this toggle.
{% endhint %}
1. In AdminX, navigate to **Authentication > Passwordless Login > Passwordless Login using 1Kosmos App**.
2. Toggle **Enable number challenge on all push notification requests** to **ON**.
3. Save the settings.
When enabled, all push notifications sent through any journey configured with Push Notification will include a number challenge.
***
### User Guide
#### Standard Push Notification Login
1. At the Windows login screen, click the **1Kosmos** tile.
2. If using the **Other User** tile, enter your username first.
3. Select **Push Notification** from the available authentication options.
4. A push notification is sent to your enrolled 1Kosmos mobile app.
5. Open the notification and tap **Yes, it's me**.
6. The Windows session unlocks and you are logged in.
{% hint style="info" %}
The push notification expires after a fixed timeout. If not approved in time, the request cancels and you must initiate a new login attempt.
{% endhint %}
#### Push Notification with Number Challenge
1. At the Windows login screen, click the **1Kosmos** tile.
2. If using the **Other User** tile, enter your username first.
3. Select **Push Notification** from the available authentication options.
4. A number is displayed on the Windows login screen.
5. A push notification is sent to your enrolled 1Kosmos mobile app showing multiple numbers.
6. In the app, tap the number that matches the number shown on the Windows screen.
7. If the correct number is selected, the Windows session unlocks and you are logged in.
{% hint style="warning" %}
If you tap the wrong number, the authentication attempt is immediately cancelled. You must return to the Windows login screen and initiate a new login attempt. Repeated wrong selections may indicate a push bombing attack — do not approve any push you did not personally initiate.
{% endhint %}
### Behavior Comparison
| Behavior | Number Challenge Disabled | Number Challenge Enabled |
| --------------------------------- | ----------------------------- | ---------------------------------------------- |
| Interface on Windows login screen | No number displayed | A number is shown on screen |
| Interface on mobile app | "Yes, it's me" consent screen | Number selection screen with multiple options |
| Required user action | Tap **Yes, it's me** | Tap the number matching the Windows screen |
| Protection against push bombing | Not provided | Active - wrong number cancels auth immediately |
***
### Troubleshooting
| Issue | Likely Cause | Resolution |
| ---------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Push notification not received | Mobile app not enrolled or disconnected; no device internet; OS notifications blocked | Verify mobile app is enrolled and connected; check device internet and notification permissions; ask user to open the app manually and check pending requests |
| Push notification expired | User did not respond within the timeout window | Initiate a new login attempt from the Windows login screen |
| Wrong number selected (Number Challenge) | User tapped incorrect number | Authentication is automatically cancelled; initiate a new login attempt; if recurring, verify no push bombing attempt is in progress |
| User tapped Cancel | User dismissed the notification intentionally or accidentally | Initiate a new login attempt; if recurring, check for unsolicited push notifications and report as a potential push bombing incident |
| Push received but app shows error | App version outdated; tenant connectivity issue | Update the 1Kosmos mobile app; verify tenant URL and connectivity from the mobile device |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/push-notification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.