Microsoft Authenticator

Overview

Microsoft Authenticator is the free mobile app that delivers MFA and passwordless sign-in for Entra ID (formerly Azure AD). It is bundled with Microsoft 365 and Entra, so for the very large population of organizations already on Microsoft, it is the default second factor with no extra license to buy. Unlike a bare TOTP app, it is managed centrally through Entra Conditional Access, which makes it an enterprise control rather than a personal tool.

What it is good at

Push approval with number matching is the practical default, and it is far better than SMS or plain TOTP because the user must enter a displayed number, which blunts push-bombing. Passwordless phone sign-in to Microsoft services is mature, and the app also stores TOTP codes for third-party sites. Because it is governed by Conditional Access, admins get policy, reporting, and registration management without bolting on another product.

Where it falls short

Push and TOTP are not phishing-resistant unless you move to the app's device-bound passkey mode or to hardware keys; number matching reduces fatigue attacks but does not stop a real-time proxy. Its value is concentrated inside the Microsoft ecosystem, and managing it well still requires the right Entra licensing tier for advanced Conditional Access. It is a strong second factor, not a standalone identity platform.

Pricing

The app is free. The MFA and Conditional Access policy that make it an enterprise control come with Entra ID, with advanced policy gated to Entra ID P1/P2 tiers. Model your licensing with the TCO calculator.

Best for, and who should look elsewhere

Choose it if you run Entra ID and Microsoft 365; it is the obvious, included choice. Teams outside Microsoft, or those who need strict phishing resistance everywhere, should consider Yubico and other FIDO2/passkey options, or Duo for cross-platform managed MFA. See the full MFA directory.

Bottom line

The default, well-managed MFA for any Microsoft shop. Turn on number matching, and move to passkeys where you need phishing resistance.