📱 Microsoft Authenticator MFA

Microsoft Authenticator MFA is a traditional multi-factor sign-in flow: you enter your password, then approve a prompt (usually number matching) in the Authenticator app.

Good transitional option

MFA is a strong improvement over password-only sign-in and is often used while organisations roll out passkeys or security keys.

How number matching works

You enter your username and password as normal.
The sign-in screen displays a two-digit number.
Microsoft Authenticator sends a notification to your phone.
You type that same number into the app and confirm with Face ID, fingerprint or PIN.

Because you have to read the number from the screen in front of you, you cannot approve a sign-in someone else started by tapping the prompt without thinking. That makes it far safer than an older "Approve / Deny" push, and safer again than a text-message code.

Can I use a third-party authenticator app?

You can use apps such as Google Authenticator, Authy or 1Password to generate the standard six-digit code (TOTP), and that works with Microsoft 365. However, the number matching push notification is specific to Microsoft Authenticator - other apps cannot receive it. If your organisation expects push approval with number matching, install Microsoft Authenticator.

At a glance

⚠️ Not passwordless (you still use a password)
⚠️ Better than SMS, but not fully phishing-resistant
✅ Works well for broad user rollout
✅ Familiar setup for most users

Best fit

Teams moving from basic MFA to stronger sign-in controls
Users not yet ready for passkeys or security keys
Transitional deployments before full passwordless rollout

Need stronger phishing resistance?

Consider a synced passkey, a device-bound passkey or a FIDO2 security key.

Set up MFA now

Back to Auth Guide

Need help? Contact your IT support team.