I'm building a verification step for an existing Entra ID (Azure AD) tenant. The goal is to verify a user via the Microsoft Authenticator number-matching prompt: push a notification to the user's registered Authenticator, obtain the two-digit number Microsoft generates, display that number in my own application UI, and have the user match it on their phone.

Constraints:

• Confidential client app registration, authorization code + PKCE.

• I want to initiate this from the backend without rendering Microsoft's hosted sign-in page to the user (no interactive browser redirect on the user's side).

• I need to obtain the number-matching value to show it in my application's interface, not on the Microsoft sign-in screen.

Questions:

1. Is there a documented, supported API or flow (identity platform, MSAL, or Microsoft Graph) that lets a relying party programmatically initiate an Authenticator push with number matching and retrieve the generated number? I haven't found the number-matching value exposed in any /authorize response, token claim, or Graph endpoint.

2. If not, is the number matching value by design internal to Microsoft's interactive MFA exchange and never surfaced to a relying party?

3. Is there any supported pattern for an app to display the number itself (rather than relying on Microsoft's sign-in UI to render it)?

I'd like to confirm whether this capability exists as a supported feature before designing around it.