Microsoft Authenticator for a small team: set-up, sign-in and new phones

Microsoft Authenticator is a free app for Android and iOS. Microsoft lists four ways it proves a sign-in is you: a notification on the phone that you approve, sign-in by phone with no password at all, a passkey kept on the phone, and a code in the app that changes every thirty seconds.

Microsoft 365 makes it the default. Under security defaults, which Microsoft switches on for new tenants, every user has to register for two-step sign-in with Authenticator notifications. Microsoft removed the fourteen-day grace period for registering on 29 July 2024. A user can also take codes from another authenticator app. Our guide to turning two-step sign-in on covers security defaults and the other two ways to enforce it.

In the Microsoft Entra admin center, go to Entra ID, then Authentication methods, then Microsoft Authenticator. On the Basics tab, enable it for all users. On the Configure tab, set "Show application name in push and passwordless notifications" and "Show geographic location in push and passwordless notifications" to Enabled, so every request on a phone says which app is asking and roughly where the sign-in comes from.

Number matching needs no setting: Microsoft applies it to every Authenticator notification, and users cannot opt out of it.

Each person does this once, at a computer, with their phone beside them.

The sign-in screen shows a number, and the notification on the phone asks for it. Microsoft says the number helps stop MFA fatigue attacks, where someone with a stolen password sends request after request until one is approved. With the two settings above, the notification also names the app and the place.

Microsoft's own rule for the notification is short: if it is legitimate, select Verify; otherwise, select Deny. A request nobody started means someone is trying to sign in as that person, so they should deny it, tell whoever runs IT at once, and change the password. Our guide to what to do after clicking a phishing link has the order.

Work accounts do not move to a new phone with a backup. Microsoft's support page is direct: "Work or school account credentials are not backed up", and after restoring the app on a new phone you sign in and register the account again. A backup made on an iPhone does not restore on Android either.

The easy case is a planned change: while the old phone still works, the person adds the new phone on the Security info page, checks a sign-in with it, and then removes the old one.

The hard case is a phone that is lost, broken or stolen. An administrator opens Entra ID, then Users, picks the person, and opens Authentication methods. Two actions there matter:

Microsoft retires old versions of the app, and a version that misses a security update can stop working for sign-in. Turning on automatic app updates on staff phones keeps the app on a version Microsoft still accepts.