Microsoft Authenticator

Is Microsoft Authenticator safe?

Yes. For a Microsoft account or a work account that runs on Microsoft Entra, it is one of the better ways to sign in: push approvals ask you to type a number shown on the sign-in screen, and workplace passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary stay on your phone. For other websites it produces ordinary six-digit codes, much like Google Authenticator (74). Apple's privacy label shows no tracking and no advertising. We score it 76/100.

The doubts are about Microsoft rather than the app. A US government review board found in 2024 that a Chinese hack succeeded "because of a cascade of security failures at Microsoft", and a 2024 research team showed that Microsoft's own sign-in system let attackers guess codes.

How number matching stopped push spam

The old push prompt simply asked "Approve or deny?". Attackers who had a stolen password could send prompt after prompt, often late at night, until a tired user tapped Approve. Security teams called this MFATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary fatigue. The Lapsus$ and Yanluowang groups used it to break into Microsoft, Uber and Cisco.

Microsoft's answer was number matching. The sign-in page shows a two-digit number, and the notification on your phone asks you to type it in. A person who did not start the sign-in has no number to type. Microsoft wrote in 2022 that number matching and extra context "eliminated MFA fatigue attacks when enabled" in its studies, and from 8 May 2023 it enforced the check for every user of Authenticator push notifications. Users cannot opt out. Wearables are the exception: Apple Watch and Android watches cannot answer number prompts, so you approve on the phone, and the iOS app has had no Apple Watch companion since January 2023.

Number matching does not stop real-time phishing. If you sign in on a fake page, the fake page shows you the real number and you hand over the session yourself. PasskeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary are the fix for that.

Passkeys and the end of passwords in the app

For work and school accounts, Authenticator can hold a device-bound passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, set up by the organisation through Microsoft Entra ID. The passkey stays on that phone and only works on the real Microsoft sign-in site, so a phishing page cannot use it.

Personal password storage went the other way. Microsoft stopped new passwords being saved in Authenticator in June 2025, ended autofill in July and removed access to saved passwords in August. Passwords synced to your Microsoft account moved to the password manager in Microsoft Edge. Payment cards were not moved and were deleted, and generated passwords that had not been saved were lost. The change made the app simpler and narrowed what an attacker could get from it, but users who relied on it had to move their passwords at short notice.

Microsoft's security record

Two incidents explain why we hold the security score down. In 2023 Chinese state hackers known as Storm-0558 used a stolen Microsoft signing key to read email at 22 organisations, including US government agencies. The Cyber Safety Review Board's report in April 2024 blamed "a cascade of security failures at Microsoft". In January 2024 Microsoft found that the Russian group Midnight Blizzard had read senior staff email after guessing the password of a legacy test account that had no multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary. The company that sells sign-in protection had left one account without it.

The app was not breached in either case. But it is only as strong as the Microsoft systems that check its answers. In June 2024 researchers at Oasis Security showed that Microsoft's sign-in service allowed 10 guesses per session with no overall limit and accepted a code for about 3 minutes. They passed a 50% chance of guessing a valid code in about 70 minutes, without the user seeing anything. Microsoft put in a temporary fix in July and a permanent one on 9 October 2024.

Backups and lost phones

Backup is a toggle you switch on. On iPhone it uses iCloud Backup, iCloud Drive and iCloud Keychain; on Android it currently uses a personal Microsoft account, and Microsoft says that moves to Google One from January 2027. Backups restore only to the same kind of phone, so moving from iPhone to Android means setting up each account again. Work and school accounts are never backed up: only the account name returns, and you register again. That is by design, because your organisation decides which phone can approve your sign-ins. Microsoft's backup page does not say whether the backup is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.

How to use Microsoft Authenticator safely

1. Deny any push request you did not start, and change that account's password at once. A surprise prompt means someone has it.
2. Never type a number into Authenticator because someone on the phone, or on Teams, asks you to.
3. Turn on backup for personal accounts if you would otherwise lose access, and keep each site's recovery codes as well.
4. If your organisation offers a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary in Authenticator, set it up. It cannot be phished like a code or a push.
5. Keep the phone's screen lock on and the app lock enabled, so a borrowed or stolen phone cannot approve sign-ins.

How we scored it

The regulatory record (88) is the strongest factor: we found no fine or order that names the app, and Microsoft's fines over other services do not count here. Scams and harmful content (78) comes next, with no content and push spam largely solved. Privacy (76) benefits from a label without tracking. Security (72) credits number matching and passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary but is held back by Microsoft's own failures, from Storm-0558 to a code-guessing flaw fixed in 2024. For Microsoft's work chat app, see Microsoft Teams (64).