Microsoft is forcing the use of their authenticator?

anon_flip_flop

Am I the only one who can no longer use an external authenticator like Aegis on a Microsoft account?

These practices forcing you to use their applications should not be allowed, if you can confirm that I am not the only one I would appreciate it.

UndercoverBozo

anon_flip_flop I just reset this week.

Confirmed Aegis QR Code worked with email. Also deleted my #.

GrouchyGrape

anon_flip_flop Microsoft still 100% supports use of TOTP, SMS, etc for mfa. However, these methods are prone to phishing attacks and therefore tenant administrators are being encouraged to require "phish-less" methods of MFA (Authenticator app, WHFB, TAP, etc), which they absolutely should.

Source: I'm a sysadmin

N1b

I'm not having a Microsoft account, but as long as they use the TOTP standard you should be able to use Aegis or any other app. Similar to Google accounts which imply you have to use the Google authenticator but the QR code works just as well with Aegis. I hate those deceiving practices and dark patterns, but it is what it is...

Have you tried scanning the code with another app?

anon_flip_flop

N1b Until now I have been able to use external authenticators but it seems that this option is no longer available, maybe it can be changed at the configuration level (I can't do it). I guess we will have to put up with these practices, when you have a monopoly at the enterprise level is very difficult to go against...

N1b

This might be helpful.

Hat

If I'm correct even with Aegis you also need to share your phone number with Microsoft to activate MFA.

The link posted further up is from July 2023. So it seem they change their rules progressively anywhere.

anon_flip_flop

Hat Yes it is necessary to add the phone number (another not very pleasant practice) but now it would be mandatory to install the microsoft authenticator app, the whole point is to put more and more obstacles to users who care about our privacy.

vontroxler

I work in IT and we are seeing users being prompted to "upgrade their security" and set up the Microsoft authenticator app.

It seems to be happening when signing in on the web apps (portal.office.com). It allows you 3 times to skip this step, but I have noticed if you open a new tab and go to the website again it will bypass the prompt.

New accounts are still able to set up an alternative verification method.

UndercoverBozo

vontroxler have you tried using a different app even though it says Microsoft Authenticator?

Most scummy companies will word it and make it seem like their Authenticator is the only one that works even though the same code works in all apps.

Also I did this all on desktop on Microsoft website and US.

r3tr0

I had that last month at a customer, we waited a couple of days and skip that step initially. There was a deadline in the future, something like 14 days.
Later it worked flawlessly with Aegis.

stil_learning

We provide IT support and have noticed this lately. As support it is sometimes necessary to share this with the client in those cases we use Aegis to establish the secret code and input that to Keepass. Aegis then allows you to generate a QR code the client can scan. With regard to Microsoft you can reset the MFA and then when you reactivate it, it will allow you to use alternative app.
This may help https://www.youtube.com/watch?v=IpmSqjNIL_E

b1k3rdude

I can confirm that Aegis Auithenticator worked flawlessly in-place of m$ authenticator. All I had to choose was "other authenticator" after I setup my phone number. And the upside if when I log into azure/intune (Im IT support) my phone isnt listed, proper ghost mode :-)

A friend (who also runs GrapheneOS (after I recomended it), reminded me I could have installed M$ authenticator and play services on a seperate user profile. So if my employer ever gets shitty about Aegis, I fallback to this as a solution.

fid02

No longer makes sense in my opinion for businesses to not progress towards passkey sign-in for their Entra ID deployments. I think an increase in MFA bypass attacks is inevitable at this point. I expect more businesses to enforce passkeys as the only sign-in option, which means you'll have to currently use Play services. Also won't currently be able to sign in to Microsoft apps with a security key, as Sandboxed Google Play doesn't currently support that.

Examples of MFA bypass attacks:
https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/
https://www.cyber.nj.gov/Home/Components/News/News/1424/214