Roll out Authenticator App

Implementation Effort: High – IT and security teams must configure tenant settings, educate users, and manage registration campaigns.

User Impact: High – Users must install the app, register it as an authentication method, and adapt to new sign-in workflows.

Overview

Rolling out the Microsoft Authenticator App enables support for secure sign-in methods including multi-factor authentication (MFA), passwordless sign-in, and phishing-resistant Device-Bound passkeys. Device-Bound passkeys are cryptographic credentials tied to a user’s specific mobile device, stored in secure hardware such as Trusted Platform Modules or Secure Enclaves, and never leave the device. This aligns with the Zero Trust principle "Verify explicitly" by requiring proof of possession of a registered, device in addition to user presence. It also supports "Assume breach" by making phishing attacks ineffective—passkeys can’t be replayed or stolen via credential phishing, as there are no passwords or shared secrets. If not deployed, organizations continue to rely on weaker authentication factors such as passwords or SMS-based codes, increasing exposure to man-in-the-middle attacks, social engineering, and credential stuffing by threat actors. The Authenticator App is a foundational component for enforcing strong, resilient identity verification across users and devices.

Reference

• Enable passkeys in Authenticator for Microsoft Entra ID
• Plan a phishing-resistant passwordless authentication deployment
• Register passkeys in Authenticator on Android and iOS devices
• Sign in with passkeys in Authenticator for Android and iOS devices
• Authentication methods in Microsoft Entra ID
• Support passkeys in Authenticator in your Microsoft Entra ID tenant