MS Authenticator on non-standard devices

Stephan-P

See https://support.microsoft.com/en-us/account-billing/jailbreak-rooted-detection-in-microsoft-authenticator-9f0431bd-675a-4f2d-b8fb-7acd18deaadc

@GrapheneOS do MS Authenticator users need to be wary of this? Should they preemptively move all their TOTP codes to an alternative app like Aegis?

Naudiz

Stephan-P Should they preemptively move all their TOTP codes to an alternative app like Aegis?

You definitely should - if you can. Unfortunately, there are a few businesses that specifically require M$ Auth. Admins can disable the use of generic TOTP. If you are in one of those companies, you're out of luck.

Stephan-P So, all may be just fine depending the detection mechanism MS will implement.

No offense, but this sounds like coping. It will not be fine. It's 99.999999% sure that a company like M$ will go the slop way of using Play Integrity to detect "iNsEcUrE dEviCeS".

GrouchyGrape

Stephan-P while I don't know all the details yet, there's definitely some misunderstanding going on and a few things are clear:

This will only affect Entra accounts. Any other TOTP generating keys you've entered will be unaffected.
If you use TOTP as your MFA, there's no way for Microsoft to know which app generated that code. I've been through the conditional access policies and don't see any way I could block "non-ms-authenticator" code generators.

I'll open up a support ticket with Microsoft, but I think most people need to calm down a bit.

Stephan-P

Technically, GrapheneOS is not jailbroken or rooted. So, all may be just fine depending the detection mechanism MS will implement.

shadowbeany

Naudiz If you are in one of those companies, you're out of luck.

Yeah. That's my case and it sucks. When possible, I always install it in older devices that aren't my daily.

Naudiz

GrouchyGrape This will only affect Entra accounts. Any other TOTP generating keys you've entered will be unaffected.

Entra accounts are pretty much the only use case why anyone would use this garbage app anyways, so I wouldn't say "only". I have MS Auth only for a specific customer for whom I couldn't create a login using Aegis or any other generic TOTP apps (see below).

GrouchyGrape If you use TOTP as your MFA, there's no way for Microsoft to know which app generated that code. I've been through the conditional access policies and don't see any way I could block "non-ms-authenticator" code generators.

I work in a job where I get a lot of guest access in different external companies and in my current projects I have at least one client that only accepts MS Auth or Hardware token. No TOTP possible. So there definitely is a way to block non-ms-authenticators.

GrouchyGrape

Naudiz I never said it's impossible for them to block TOTP, that's obviously possible. What I said was:

GrouchyGrape If you use TOTP as your MFA, there's no way for Microsoft to know which app generated that code

If TOTP is allowed on the tenant, then any TOTP generator will work.

GrouchyGrape

Naudiz you're not understanding my post and confusing hardware based auth (e.g. passkeys) with non-hardware based (e.g. TOTP). Everything I said still stands.

Naudiz

GrouchyGrape
I'm not confusing hardware and software based auth. What makes you think I did?
I was giving you an example of a customer who required MS authenticator (software) or hardware tokens, while blocking generic TOTP. You are just wrong when you say it's not possible for company admins to block generic TOTP - it definitely is.

Stephan-P

Let's cool down the conversation and wait and see how this develops.

Meanwhile one can try out an alternative TOTP generator for their MS business account. (I certainly will.) And if that's working fine, then that's a way to go. And if the company does require MS Authenticator and nothing else, then this will be an early discussion with the powers that be. (Maybe buy a very simple 2nd device just for MS Authenticator.)

user2025

Hmmm..lots of noise here !!!

M365 registers the phone serial and model / ID in their database when you enroll your phone first time,via the QR code process.
Your phone will not work unless accepts push notifications sent by M365 backend. There is a two ways flowing traffic and authentication between them.

Also...if an end user changes phones, the new device will not be accepted after you transfer the Authenticator app with the clone process !!! User needs to either register the new phone while still has access to older phone OR reset all MFA records and start fresh...

So,i feel its going to be messy for Authenticator app on GOS,if thats what MS wants to achieve.

Stephan-P

I just bit the bullet(s).
For both my personal Microsoft account as well as the Business MS account, I've created additional 2-factor verification code methods.
After having confirmed that they function, I removed the MS Authenticator verfifcation methods from my accounts.
And once again, I confirmed that the newly added TOTP-codes are functional.

So, I've removed MS Authenticator from my device. As a matter of fact they abandoned me some months ago when they removed the password management functionality that I used for my Business MS Account.

user2025

Stephan-P
Im using a lot the code notification and validation for logon to M365 account. Havent got the courage to recreate MFA on other nonMS accounts...yet.

On the M365, i have created additional "account device"using a new QR code and it worked:
-notification popped up
-confirmed the number and sent
-received by M365 backend
-logged in succesfully

On the portal,the device name is Pixel 9 Pro XL (and not GrapheneOS).

Oggyo

Stephan-P

By default, the TOTP auth. method is allowed for MFA. But some organizations change the policy to enforce only the push method via MS Authenticator, which Microsoft puts above the others (e.g. TOTP, email, SMS).

So, consider yourself lucky you can remove this sh*t from your phone. :-)

schweizer

MS authenticator works fine without play services.

TOTP is unsafe, zero security against phishing so it should be avoided independently of which app is used to generate the codes.

And I doubt it gets a lot of information like serial number because it runs without special permissions.

So everything is fine. I mean you do not need the app if you do not want to be a MS customer.