Microsoft Authenticator in 2026: push, passkeys, and TOTP

Most people meet Microsoft Authenticator the way they meet a badge lanyard: it is issued to them. An employer or a university switches on multi-factor authentication, IT sends a two-line email, and the app lands on the phone whether anyone asked for it or not. What almost nobody is told is that the same app quietly does two other jobs — and that it is a competent generic authenticator for accounts that have nothing to do with Microsoft.

Here is what the app is in 2026, how to set it up for either kind of account, why its push prompts make you type numbers, and where it locks your second factors into one vendor's garden.

Three apps wearing one icon

Microsoft Authenticator is one download that holds two kinds of life. Your personal Microsoft account — the one behind Outlook.com, Xbox, OneDrive — lives next to your work or school account, the Microsoft 365 login governed by whatever Entra ID policy your organization sets. Entra ID is the directory Microsoft formerly sold as Azure AD — hence the enduring habit of calling this Azure AD MFA. Microsoft's documentation for admins lists the app's capabilities plainly: passkey and passwordless sign-in, MFA by push notification, and standard verification codes (learn.microsoft.com).

The app plays three distinct roles:

• Push approvals for Microsoft-owned accounts. You sign in on a laptop, your phone buzzes, you confirm. Push works for work and school accounts — if the administrator allows it — and for personal Microsoft accounts. It does not work for anything else: Microsoft's own FAQ states that notifications "won't work for third-party accounts, like Google or Facebook" (support.microsoft.com).
• Passkey and passwordless sign-in, mainly for consumer accounts, where the registered phone effectively becomes the credential.
• A plain TOTP generator for any site that shows you a QR code, from a forum to a crypto exchange.

That third role is the underrated one. Any service that supports authenticator apps speaks the same open protocol — what TOTP is is a shared secret plus a clock — and Microsoft's app implements it like any other. If you are setting up Gmail 2FA or adding a second factor to a store account, the app generates the six-digit codes.

Push approvals and the number you have to type

The push prompt is not a simple "Approve / Deny" anymore. In 2026, Microsoft's number matching is standard: the sign-in screen on your computer displays a two-digit number, and the app asks you to type that number before the Approve button appears, then confirms with your fingerprint, face, or device PIN. Microsoft's Entra documentation describes this as a security improvement for push notifications, and it has become the default behavior that neither users nor admins can simply switch off (how number matching works, protecting authentication methods).

The reason is a real attack with a boring name. In an MFA-fatigue or push-bombing attack, an attacker who already has your password sends prompt after prompt — dozens, at 2 a.m. — hoping you will tap Approve just to make the buzzing stop. Security vendor Proofpoint's threat reference describes exactly this pattern of bombardment-then-approval, the technique behind the 2022 Uber breach, where the contractor approved after the attacker followed up on WhatsApp posing as IT (proofpoint.com). Number matching breaks the reflex: approving now requires reading a number off the screen in front of the attacker's login attempt and typing it into the phone. Fatigue stops being sufficient.

Passkeys and passwordless sign-in

For personal accounts, the app can go further than approving logins — it can replace the password. Register the account for passwordless phone sign-in and your username plus an approval plus your biometric gets you in, no password typed anywhere. Passkey support has since landed in the same app for Microsoft accounts (authentication methods in Entra ID). Whether you get to use it at work depends on policy: passkeys for Entra ID accounts are an administrator decision, not a user one.

Passkeys are the strongest of the three roles because they are bound to the real sign-in origin — a phishing page can relay a typed code, but it cannot make a passkey sign in to a domain it does not control. For accounts where phishing is the live threat, hardware security keys take the same idea off your phone entirely.

Setting it up for a personal Microsoft account

Microsoft keeps the toggle in the account security pages, and the current path is:

1. Sign in at account.microsoft.com/security and open Advanced security options.
2. Find the two-step verification area and turn the feature on — Microsoft's support page describes the control as "Under Additional security and Two-step verification choose Turn on" (support.microsoft.com).
3. Follow the wizard: it offers the authenticator app, walks you through installing it, and shows a QR code.
4. In the app, tap the plus, choose personal Microsoft account, and sign in to link the phone.

Keep a second method on the same page — an alternate email or a phone number. It is the way back in if the phone with the app goes into a lake.

Setting it up for a work or school account

Here the app installs upside down: your organization decides, you comply. If policy requires the authenticator app, you will be marched through enrollment at sign-in. If you are doing it yourself — new phone, or you want push instead of codes — the self-service route is the Security info page, reachable through My Sign-Ins at mysignins.microsoft.com: Add sign-in method → Authenticator app, then a QR code you scan from the app's plus menu (how to add accounts). The shortcut aka.ms/mysecurityinfo opens the same page.

Administrators control the surrounding policy: whether push notifications are permitted at all, whether registration is forced through a sign-in prompt, and the Conditional Access rules that decide when the second factor is actually demanded. A user can switch from codes to push. Only the tenant admin can decide the app is mandatory.

Moving to a new phone

This is where the two kinds of account diverge, painfully.

Personal accounts travel by backup. The app backs up your personal Microsoft account credentials and — if you enabled it — your third-party TOTP entries. On iOS the backup rides on iCloud, and Microsoft's troubleshooting checklist tells the familiar story: iCloud Drive on, iCloud Keychain on, iCloud Backup on, the Authenticator toggle lit in your Saved to iCloud list, app version 6.8.33 or later, and the app opened at least once before you switch phones. On the new device, Microsoft's FAQ advises uninstalling and reinstalling the app if the backup does not appear (Microsoft Authenticator FAQs). Android backs up through a personal Microsoft account instead of iCloud, which at least means cross-vendor restores work.

Work and school accounts do not travel. They are tied to your organization's tenant and its policies, so the new-phone routine is re-registration: add the account again from the Security info page, then delete the old entry. If the old phone is already gone and no other method exists, you are into help-desk territory — proof of identity, waiting, and no guarantee.

Lose the consumer backup too? The escape route is the same Advanced security options page: remove the old authenticator method and register the new device, using your remaining second method. With no remaining method, account recovery is the slow road. Back up before you need to.

Push, passkey, or TOTP inside the app

Method	What you do	What it stops	Where it works
Push with number matching	Type the two-digit number, approve with biometric	Push-bombing and reflex approvals; password theft	Work or school accounts and personal Microsoft accounts only
Passkey / passwordless	Approve and biometric, no password	Phishing and credential theft, password reuse	Personal Microsoft accounts; work accounts only if policy allows
TOTP codes	Type the rotating six-digit code	Password theft and reuse; not real-time phishing relay	Any site or service offering authenticator-app setup

The honest note: one vendor, one basket

As a generic TOTP generator, the app is solid — free, standard-compliant, backed up, maintained by a company that is not disappearing. The catch is portability. Your third-party secrets live in Microsoft's app, on Microsoft's terms, and moving them to another app later means re-enrolling at every service by hand, because there is no neutral export. Your work account is, by design, your employer's to control. And the more second factors pile into one app tied to one ecosystem, the more a single wrong tap on an "Approve" screen matters.

If that trade suits you, it is a reasonable one. If you would rather your second factors move when you do, portable options exist: the guest generator at 2FA by DependsiT takes a Base32 secret, an otpauth:// URI, a QR code image, or a Google Authenticator export and produces codes entirely in the page — no account, no install, nothing stored, and a reload clears everything. Add the zero-knowledge vault and entries are encrypted on-device before upload — PBKDF2 salted derivation, HKDF key separation, AES-256-GCM, with Argon2id protecting login — so the server holds only ciphertext and your codes work on any device you sign in from.

For the enterprise counterpart — the app your university or hospital probably forced on you instead — the Duo 2FA walkthrough is the companion piece.

Frequently asked questions

Is Microsoft Authenticator free?

Yes. The app costs nothing, works as a plain TOTP generator without any Microsoft account, and the personal-account features — push, passwordless sign-in, cloud backup — are free. What can cost money sits on the organization's side: work or school features are governed by whatever Entra ID licensing and policies the employer or school configures. You never pay Microsoft directly for the app itself.

Does it work with Google, Facebook, and other non-Microsoft sites?

Yes, as a code generator. Add the account, scan the site's QR code, and the app produces standard six-digit TOTP codes. What you do not get for those accounts is push approval — Microsoft's FAQ is explicit that notifications work only for Microsoft accounts. Third-party entries also follow the app's backup settings, so check that backup is on before you rely on it surviving a phone swap.

Can I run it on two phones at once?

For personal accounts, the design is one active registration — you re-register on the new device, and the old one stops being prompted. For work or school accounts, the Security info page lets you add the new phone's authenticator while the old one still works, then remove the dead entry. That ordering — add first, remove second — is the difference between a five-minute migration and a call to the help desk.

What happens to the app when I leave my employer?

The work or school entry simply loses its tenant to talk to — it stops approving anything the moment the account is disabled, and the organization never had a claim on your other entries. Your personal Microsoft account and your third-party TOTP accounts keep generating codes untouched. If you only ever used the app for work, that is the moment it becomes an empty icon you can delete.

Do passkeys in the app replace my password?

For a personal Microsoft account, effectively yes — passwordless sign-in means the password stops being part of the daily flow, and the app plus your biometric is the credential. Keep the password and recovery methods alive anyway — they are still the path back in if you lose the phone. Passkeys narrow the password's role. They do not retire it.

If you are re-enrolling accounts anyway, that is the cheapest moment to try a portable setup: open the guest generator, paste one secret, and see which home you prefer for your second factors.