Microsoft Authenticator Uwa
Athenasby Regalado
The Microsoft Authenticator app provides another level of security to your Microsoft Entra work or school account or your Microsoft account and is available for Android and iOS. With the Microsoft Authenticator app, users can authenticate in a passwordless way during sign-in, or another verification option during self-service password reset (SSPR) or multifactor authentication events.
You can now apply passkeys for user authentication. Users can then receive a notification through their mobile app for approving or denying the Authenticator app to generate an OATH verification code. This code can then be entered in a sign-in interface. If you enable both a notification and verification code, users who register the Authenticator app can use either method to verify their identity using passkeys.
Passkeys in the Authenticator app are device-bound to ensure that they never leave the device they were created on. On an iOS device, Authenticator uses the Secure Enclave to create the passkey. On Android, we create the passkey in the Secure Element on devices that support it, or fall back to the Trusted Execution Environment (TEE).
Passkeys in Authenticator aren't backed up and can't be restored on a new device. To create passkeys on a new device, use the passkey on an older device, or use another authentication method to re-create the passkey.
Instead of seeing a prompt for a password after entering a username, users who enable phone sign-in from the Authenticator app sees a message to enter a number in their app. When the correct number is selected, the sign-in process is complete.
The Authenticator app can help prevent unauthorized access to accounts and stop fraudulent transactions by pushing a notification to your smartphone or tablet. Users view the notification, and if it's legitimate, select Verify. Otherwise, they can select Deny.
Starting in August, 2023, anomalous sign-ins don't generate notifications, similarly to how sign-ins from unfamiliar locations don't generate notifications. To approve an anomalous sign-in, users can open Microsoft Authenticator, or Authenticator Lite in a relevant companion app like Outlook. Then they can either pull down to refresh or tap Refresh, and approve the request.
In China, the Notification through mobile app method on Android devices doesn't work because as Google play services (including push notifications) are blocked in the region. However, iOS notifications do work. For Android devices, alternate authentication methods should be made available for those users.
The Authenticator app can be used as a software token to generate an OATH verification code. After entering your username and password, you enter the code provided by the Authenticator app into the sign-in interface. The verification code provides a second form of authentication.
Consistent with the guidelines outlined in NIST SP 800-63B, authenticators used by US government agencies are required to use FIPS 140 validated cryptography. This guideline helps US government agencies meet the requirements of Executive Order (EO) 14028. Additionally, this guideline helps other regulated industries such as healthcare organizations working with Electronic Prescriptions for Controlled Substances (EPCS) meet their regulatory requirements.
FIPS 140 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. The Cryptographic Module Validation Program (CMVP) maintains the testing against the FIPS 140 standard.
Beginning with version 6.6.8, Microsoft Authenticator for iOS uses the native Apple CoreCrypto module for FIPS validated cryptography on Apple iOS FIPS 140 compliant devices. All Microsoft Entra authentications using phishing-resistant device-bound passkeys, push multifactor authentications (MFA), passwordless phone sign-in (PSI), and time-based one-time passcodes (TOTP) use the FIPS cryptography.
In new updates from the previous version of this article: Microsoft Authenticator isn't yet FIPS 140 compliant on Android. Microsoft Authenticator on Android is currently pending FIPS compliance certification to support our customers that may require FIPS validated cryptography.
Users can access My Security info (see the URLs in the next section) or by selecting Security info from MyAccount to manage and add more Microsoft Authenticator registrations. Specific icons are used to differentiate whether the Microsoft Authenticator registration is passwordless phone sign-in or MFA.
Microsoft continuously updates Authenticator to maintain a high level of security. To ensure that your users are getting the best experience possible, we recommend having them continuously update their Authenticator App. In the case of critical security updates, app versions that aren't up to date may cease to work and may block users from completing their authentications. If a user is using a version of the app that is not supported, they will be prompted to upgrade to the latest version before being able to proceed with authentications.
As long as you load the secret key for the specific authenticator, you can load the same authenticator to multiple Microsoft Accounts through the Microsoft Authenticator application. For example, I have loaded the same TOTP authenticator to (Authy, WinAuth, Google, Battle.net, Lastpass Authenticator, and Microsoft Authenticator). All I needed to do was provide the secret code each application. I have synchronized more than a dozen authenticators across every single device that I use. Since 1Password supports TOTP, I have also synchronized them there.
You would have to use a different TOTP authenticator, more than likely, unless the bank allows you to provide your own secret code instead of telling you what the secret code will be. However, you could have synchronized your authenticators to any number of devices. That is the only reason I feel comfortable using them.
I tried the authenticator app once but found financial institution 2FA text authentications to be completely adequate. But if you use the Authenticator it can be used on two accounts. Refer also to my comments above about two people, but if they share credentials you can probably do this.
Multi-factor authentication (MFA) increases account security by requiring multiple forms of verification to prove your identity when signing into an application. CU Boulder faculty, students, and staff can now securely log in and use Microsoft 365 with MFA.
When registering for MFA, enter a phone number to receive a text message or phone call. After registering with a phone, you can install the Microsoft Authenticator Mobile App which allows you to click a button on your phone or smart watch to quickly and easily login, when prompted.
Upon your next login to Microsoft 365, you will be prompted to register for multi-factor authentication. Follow the Register and set up MFA instructions for step-by-step instructions for registering. For additional information, please see our Multi-Factor Authentication FAQ.
Multi-factor authentication (MFA) is a simple way to increase account security by requiring multiple forms of verification to prove your identity when signing into an application. This is generally something you know, like a password, and something you have, like a personal phone. Many institutions and applications use some form of MFA to login, especially when using a new device. Microsoft 365 multi-factor authentication will increase the protection on all Microsoft 365 services and applications, including Office desktop applications, email, Teams, OneDrive, and Sharepoint. For your convenience, your sign-in session on your regular devices will not require you to login or use multi-factor often, but it will protect your account if any suspicious attempts to login are detected.
Both CU Boulder and Microsoft are not permitted to use this information for marketing, tracking, or data mining purposes. We have contractual agreements with Microsoft that protect your personal information. Your phone number will only be used to validate that you are who you say you are when using the Microsoft 365 services. MFA is an additional security measure that is designed to protect your personal information.
If you decide to use FIDO2 tokens, it is highly recommended to register a backup method, such as a phone, in addition to your token in case you misplace it. Learn how to edit backup methods for MFA in the beginning of our registering and using the authenticator app tutorial.
To give campus users the right balance of security and ease of use, we've enabled a setting which takes into account many factors to determine if a login attempt is suspicious or not. If you mostly access Microsoft apps using the same devices and patterns, you should rarely if ever be prompted with MFA. However, if you frequently travel internationally, log in to your Microsoft apps and email on these trips or use public computers or kiosks, you could expect to be prompted on a higher frequency that corresponds to these activities which appear to be more risky.
Before using the Authenticator app, OIT recommends registering a phone number for authentication. If you only use the authenticator app you may be locked out of your account temporarily if you lose or replace your mobile phone.
If you're unable to log in or change your authentication information (see How can I update my phone number or change authentication preferences? below), please contact the IT Service Center at 303-735-4357 or oit...@colorado.edu for assistance resetting MFA.
Visit the Apple app store or Google play store on your device and install the Microsoft Authenticator app. Alternatively, the authenticator application can be downloaded directly to your desktop using the Microsoft Authenticator Website or by scanning the QR code with your phone.
Using the camera on your phone, scan the QR Code in the application and test the push notification flow as part of this experience. Additional written instructions can be found on the Microsoft website.
e59dfda104