Can I refuse MS Authenticator?
So my company decided to migrate office suite and email etc to Microsoft365. Whatever. But for 2FA login they decided to disable the option to choose "any authenticator" and force Microsoft Authenticator on the (private) phones of both employees and volunteers. Is there any valid reason why they would do this, like it's demonstrably safer? Or is this a battle I can pick to shield myself a little from MS?
I work in cybersecurity for a large company, which also uses the MS Authenticator app on personal phones (I have it on mine). I do get the whole "Microsoft bad" knee-jerk reaction. I'm typing this from my personal system, running Arch Linux after accepting the difficulties of gaming on Linux because I sure as fuck don't want to deal with Microsoft's crap in Windows 11. That said, I think you're picking the wrong hill to die on here.
In this day and age, Two Factor Authentication (2FA) is part of Security 101. So, you're going to be asked to do something to have 2FA working on your account. And oddly enough, one of the reasons that the company is asking you to install it on your own phone is that many people really hate fiddling with multiple phones (that's the real alternative). There was a time, not all that long ago, where people were screaming for more BYOD. Now that it can be done reasonably securely, companies have gone "all in" on it. It's much cheaper and easier than a lot of the alternatives. I'd love to convince my company to switch over to Yubikeys or the like. As good as push authentication is, it is still vulnerable to social engineering and notification exhaustion attacks. But, like everything in security, it's a trade off between convenience, cost and security. So, that higher level of security is only used for accessing secure enclaves where highly sensitive data is kept.
As for the "why do they pick only this app", it's likely some combination of picking a perceived more secure option and "picking the easiest path". For all the shit Microsoft gets (and they deserve a lot of it), the authenticator app is actually one of the better things they have done. SMS and apps like Duo or other Time based One Time Password (TOTP) solutions, can be ok for 2FA. But, they have a well known weakness around social engineering. And while Microsoft's "type this number" system is only marginally better, it creates one more hurdle for the attacker to get over with the user. As a network defender, the biggest vulnerability we deal with is the interface between the chair and the keyboard. The network would be so much more secure if I could just get rid of all the damned users. But, management insists on letting people actually use their computers, so we need to find a balance where users have as many chances as is practical to remember us saying "IT will never ask you to do this!" And that extra step of typing in the number from the screen is putting one more roadblock in the way of people just blinding giving up their credentials. It's a more active thing for the user to do and may mean they turn their critical thinking skills on just long enough to stop the attack. I will agree that this is a dubious justification, but network defenders really are in a state of throwing anything they can at this problem.
Along with that extra security step, there's probably a bit of laziness involved in picking the Microsoft option. Your company picked O365 for productivity software. While yes, "Microsoft bad" the fact is they won the productivity suite war long, long ago. Management won't give a shit about some sort of ideological rejection of Microsoft. As much as some groups may dislike it, the world runs on Microsoft Office. And Microsoft is the king of making IT's job a lot easier if IT just picks "the Microsoft way". This is at the heart of Extend, Embrace, Extinguish. Once a company picks Microsoft for anything, it becomes much easier to just pick Microsoft for everything. While I haven't personally set up O365 authentication, I'm willing to bet that this is also the case here. Microsoft wants IT teams to pick Microsoft and will make their UIs even worse for IT teams trying to pick "not Microsoft". From the perspective of IT, you wanting to do something else creates extra work for them. If your justification is "Microsoft bad", they are going to tell you to go get fucked. Sure, some of them might agree with you. I spent more than a decade as a Windows sysadmin and even I hate Microsoft. But being asked to stand up and support a whole bunch because of shit for one user's unwillingness to use a Microsoft app, that's gonna be a "no". You're going to need a real business justification to go with that.
That takes us to the privacy question. And I'll admit I don't have solid answers here. On Android, the app asks for permissions to "Camera", "Files and Media" and "Location". I personally have all three of these set to "Do Not Allow". I've not had any issues with the authentication working; so, I suspect none of these permissions are actually required. I have no idea what the iOS version of the app requires. So, YMMV. With no other permissions, the ability of the app to spy on me is pretty limited. Sure, it might have some sooper sekret squirrel stuff buried in it. But, if that is your threat model, and you are not an activist in an authoritarian country or a journalist, you really need to get some perspective. No one, not even Microsoft is trying that hard to figure out the porn you are watching on your phone. Microsoft tracking where you log in to your work from is not all that important of information. And it's really darned useful for cyber security teams trying to keep attackers out of the network.
So ya, this is really not a battle worth picking. It may be that they have picked this app simply because "no one ever got fired for picking Microsoft". But, you are also trying to fight IT simplifying their processes for no real reason. The impetus isn't really on IT to demonstrate why they picked this app. It is a secure way to do 2FA and they likely have a lot of time, effort and money wrapped up in supporting this solution. But, you want to be a special snowflake because "Microsoft bad". Ya, fuck right off with that shit. Unless you are going to take the time to reverse engineer the app and show why the company shouldn't pick it, you're just being a whiny pain in the arse. Install the app, remove it's permissions and move on with life. Or, throw a fit and have the joys of dealing with two phones. Trust me, after a year or so of that, the MS Authenticator app on your personal phone will feel like a hell of a lot better idea.
This is incredibly well said and I agree 100%. I'll just add that software TOTP is weaker than the MS Authenticator with number matching because the TOTP seed can still be intercepted and/or stolen by an attacker.
Ever notice that TOTP can be backed up and restored to a new device? If it can be transferred, then the device no longer counts for the "something you have" second factor in my threat model.
While I prefer pure phishing-resistant MFA methods (FIDO2, WHFB, or CBA), the support isn't quite there yet for mobile devices (especially mobile browsers) so the MS Authenticator is the best alternative we have.
Unless you are going to take the time to reverse engineer the app and show why the company shouldn't pick it, you're just being a whiny pain in the arse.
You're god damn right they are, and they have every right to be. I'm in It too and I'm absolutely sick of the condescending attitude and downright laziness of people in the field who constantly act like what the users want doesn't matter. If they don't want it on their personal device, they don't need a damn reason.
This job is getting easier all the time, complaining because users don't want Microsoft trash on their phone might make marginally more work for you is exactly as whiny.
Or, throw a fit and have the joys of dealing with two phones. Trust me, after a year or so of that, the MS Authenticator app on your personal phone will feel like a hell of a lot better idea.
I see this all the time and it's downright hysterical. Who the hell can't handle having to have two devices on them?
"Oh yeah you'll regret asking for this! Just wait till you have to pull out that other thing in your bag occasionally! You'll be sorry you ever spoke up!"
Also, develop some pattern recognition. If you can't see how Microsoft makes this substantially worse once other methods have been choked out, you haven't learned a thing about them in the last 30 years.
You’re god damn right they are, and they have every right to be. I’m in It too and I’m absolutely sick of the condescending attitude and downright laziness of people in the field who constantly act like what the users want doesn’t matter. If they don’t want it on their personal device, they don’t need a damn reason.
Sure, and I suspect they company will have another option for folks who either can't or won't put the application on their personal device. It's probably also going to be far less convenient for the user. Demanding that the company implement the user's preferred option is where the problem arises.
complaining because users don’t want Microsoft trash on their phone might make marginally more work for you is exactly as whiny.
It's a matter of scale. In a company of any size, you are going to find someone who objects to almost anything. This user doesn't like Microsoft. Ok, let's implement Google. Oh wait, the user over there doesn't like Google. This will go on and on until the IT department is supporting lots of different applications and each one will have a non-zero cost in time and effort. And each of those "small things" has a way of adding up to a big headache for IT. We live in a world of finite resources, and IT departments are usually dealing with even more limited resources. At some point they have to be able to cut their losses and say, "here are the officially supported solutions, pick one". While this creates issues for individuals throughout the organization, it's usually small issues, spread out over lots of people versus lots of small issues concentrated in one group.
If you're in IT, you've likely seen (and probably supported) this sort of standardization in action. I can't count the number of places where every system is some flavor of Dell or HP. And the larger organizations usually have a couple of standard configurations around expected use case. You're an office worker, here's a basic laptop with 16Gb of RAM, and mid level CPU and fuck all for a GPU. Developer? Right, here's the top end CPU, as much RAM as we can stuff in the box and maybe a discreet GPU. AI/ML work? here's the login for AWS. Edge cases will get dealt with in a one-off fashion, there's always going to be the random Mac running around the network, but support will always be sketchy for those. It's all down to standardizing on a few, well known solutions to make support and troubleshooting easier. Sure, there are small shops out there willing to live with beige box deployments. Again, that does not scale.
I see this all the time and it’s downright hysterical. Who the hell can’t handle having to have two devices on them? “Oh yeah you’ll regret asking for this! Just wait till you have to pull out that other thing in your bag occasionally! You’ll be sorry you ever spoke up!”
Hey, if that's your thing, great. But, there is a reason BYOD took off. And a lot of that was on users pushing for it. Having been on the implementation side, it certainly wasn't IT or security departments pushing for this. BYOD is still a goddamn nightmare from an insider threat perspective. And it causes no end of headaches for Help Desks trying to support FSM knows what ancient piece of crap someone dredges up from the depths of history. Yes, it's a bit of cop out to give the user a crappy solution, because they push back against the easy one. But, it's also a matter of trying to keep things working in a standardized fashion. A standard configuration phone, with the required pre-installed, gives the user the option they want and also keeps IT from having do deal with yet more non-standard systems. It's a win for everyone, even if it's not the win the user wanted.
Also, develop some pattern recognition. If you can’t see how Microsoft makes this substantially worse once other methods have been choked out, you haven’t learned a thing about them in the last 30 years.
I do understand how bad Microsoft can be. I was an early adopter of Windows Me. And also have memories of Microsoft whining about de-coupling IE from the OS. And I don't want MS to win out as the authentication app for everyone. That said, I still believe that the Microsoft Authenticator app on a personal device is the wrong hill to die on. There is a lot of non-Microsoft software out there and there are plenty of options out there. But, Microsoft software using the Microsoft app isn't surprising or insidious.
Who the hell can't handle having to have two devices on them?
Hillary Clinton
To add on, at my work we started getting yubikeys for the people who didnt want Microsoft's authenticator on their phone and found they still need to download the mfa to set up the yubikey in the first place. So its not a perfect solution if you dont want the authenticator to touch your phone at all.
I can also confirm that the help desk members who are not enlightened about Microsoft will ridicule you for not wanting the MFA even if its reasonable to not want Microsoft on your phone. As much as we think all techs are Linux nerds, I have the opposite at my work. Some of the higher up techs are constantly trying to get people to switch to windows 11...
When I got the few emails from users at my organization who refused to use the app on their phones, I was ecstatic and I went to bat for them with our section director who insisted on making it mandatory, no exceptions.
Unfortunately most people in IT seem to just be lazy and believe "if it makes my job easier, absolutely no other concerns are relevant".
Hey now, this doesn't fit with our narrative of the evil evil company here. Get this out of here! Just because it's a 2FA app doesn't negate that it's microshitz!
Fuck me I wish we could get more of these actual thoughtful answers instead of generic "hurdurr muh privacy megacorp bad"
All extremely good reasons to need the MFA.
Howerver it is on the company to provide the hardware. My phone is my phone. They didn't buy it, they don't pay for it, they don't get any say in what gets installed. I don't have to pay for my company provided computer either, so I don't care what they need me to install on that.
My phone is my phone. They didn’t buy it, they don’t pay for it
And that's completely fair. As I said above, the end result will almost certainly be a company provided phone with company provided apps. I've seen (and had) both solutions. It all comes down to how you view the risks. If you see running a Microsoft app on your personal phone as too great a risk to your privacy, then go for the two phone option. Personally, I don't see that as a high risk and think it's kinda silly.
You work in cybersecurity, yet you have company-controlled assets on your personal phone?
X DOUBT
Either you don’t give a single sh*t about your personal privacy, or…
And no, this isn’t “Microsoft bad”, this is “your company is inherently and fundamentally untrustworthy”. The app is, IMHO, one of the best ones out there, I would just never trust any company I worked for to keep their nose out of my personal life. A lot of the software that companies use to lock down mobile devices are hella invasive, and any company asset on a phone typically includes a demand to install the security software as well. Any of that shit should ALWAYS be on a company-provided phone, bro.
You work in cybersecurity, yet you have company-controlled assets on your personal phone?
X DOUBT
Either you don’t give a single sh*t about your personal privacy, or…
Here's the rub, I've been through enough of this to take a realistic, risk based approach to security. Knee-jerk reactions like the one you are giving are not really useful. Step back for a moment and think about what's going on here. First and foremost, this isn't MDM on a device, that's entirely different from installing the MS Authenticator app from the public Google Play store and adding a work account to it. So no, the company is not able to go rooting around in the user's device willy-nilly. Second, even with MDM, IT control of the user's device isn't what it used to be. Google implemented containerization of work profiles some time back. Without Work Profiles and containerization, I would agree that enrolling my personal device in MDM carries too much risk to my privacy and also having my device remote wiped. But, the advance of technology has altered that calculus. While there are still risks to consider with having a work profile on my device, it's also not as worrisome as it used to be.
Security isn't some binary thing. There is no hard and fast set of rules, given from some entity on high. It's a game of deciding what risks are acceptable and what risks need to be mitigated and how. If you work for a company which you believe is trying to use MDM to go rooting around in your personal device, I'd suggest finding an new job. This isn't to say you should trust the company 100%; but, you need to take a realistic look at what the ask is, what risks it carries and if the trade-off in convenience is worth it. The risks inherent in the MS Authenticator app are basically nil. At least on Android, you can audit it's permissions and disable the ones you don't want it to have. The app provides zero control over the device to the company. Really, there's just nothing there to get your panties in a bunch about.
But hey, if knee-jerk reactions are your thing, then you do you. This whole tempest in a teapot still amounts to "Microsoft bad".
No company has any right to force people to use their private phones for company purposes. I'd absolutely refuse to let them install anything whatsoever on my phone. If they want me to use a phone for work, they'll have to give me one.
Many work places require employees to bring their own tools (eg auto mechanic). Requiring a phone or tablet is probably legal.
No company has any right to force people to use their private phones for company purposes.
Got a reputable source on that one that’s valid for all 50 states?
"Diplomjodler" sounds German so probably different laws apply…
Not a good solution but a decent one. Create a work profile on your phone, using Shelter (Fdroid, open source), and put all your work apps on that. Your data and processes are isolated and you can turn off all your work apps with a single tap. It's like a secondary virtual phone.
Don't mix business and personal.
Don't Install any corp app on a personal phone. No matter what.
I work for a municipal government where we all receive a phone stipend because of 2FA.
If we use our personal phones for city business, they become searchable in Open Records Requests.
Also, the Microsoft Intune app, which checks if your device is compliant, requires a high level permission which allows it to remote wipe your device. This is in case your device has sensitive data and gets stolen/falls into the wrong hands. This is a very risky direction where we are handing off admin access of our phone to our employers.
I work in tech, and have had multiple employees claim they only have "dumb" phones for what I'm pretty sure is this exact reason. And I never blame them, just put the heat on IT to find a solution.
Demand hardware tokens for authentication.
Do hardware tokens support Linux nowadays?
Depends on the type of token. The type that would be needed in this case doesn't need a computer to use, it displays the codes on a small screen.
There are also key generators used for electronic signatures that need to be connected to the PC; those can work on Linux but it depends on whether whoever provisioned them wanted to do that. Lots of companies who issue such tokens only put the Windows stuff on them.
Or tell your IT department to think ahead and skip the part where we use personal devices to ensure the security of company devices and data. That will eventually change, and we're going to look back on it the same way we look back on letting users receive work emails on any device with nothing but a password.
If you want security, use company devices. It's really simple.
Can you claim that you don't have a smartphone? Then they'd either have to provide an alternative authentication method, or provide you with a phone.
I've been part of the Microsoft Bad crowd for well over 25 years now, but there are a few things that I will concede that MS has done well. Authenticator is one of them. I haven't looked much into the privacy aspect of it, though.
Don't do that. Just say they will provide you with an authenticator paid for by them.
If it has Microsoft's name on it, the privacy implications are horrendous. Guaranteed.
It's odd that I prefer Microsoft to Google in terms of privacy at this point
Strong disagree with Microsoft Authenticator being well done - anything that is needlessly incompatible with competitors is bullshit. Either make your authenticator use the standard or fuck off.
Push Authentication in the MS Authenticator is Microsoft's proprietary thing. And I think that's probably what we're talking about here.
Might be interpreting your comment wrong, but it is compatible with competitors. You don't need to use Authenticator as your 2FA for a personal Microsoft account, and you can use Authenticator in place of any other TOTP app. It's OP's IT department that have chosen to disable the option to use other apps.
I did this at my work and got a little dongle that displays a string of numbers I have to enter when prompted.
Not as well as Bitwarden.
Except that the Authenticator is being forced in place of other, third party apps.
I don't mind using my phone to authenticate. But now I'm not allowed to do it from Bitwarden. I must use their app.
The ms authenticator works in 'reverse' in that you type the code on the screen into the phone. I assume this is preferable to corporate as you can't be social engineered into giving out a 2fa token. It also has a "no this wasn't me" button to allow you to (I assume) notify IT if you are getting requests that are not you.
I don't believe that the authenticator app gives them access to anything on your phone? (Happy to learn here) And I think android lets you make some kind of business partition if you feel the need to?
And the authenticator is configurable and they can enforce some device security like not rooted, bootloader locked, storage encryption is on through the Intune work profile. If you work on a bank, you don't want the 2FA to even live on a device where the user gives root access to random apps that could extract the keys (although at this point come on you can probably afford Yubikeys).
As a user, not a fan, but as an IT department it makes complete sense.
I mean the only real issue I see with this is that they require people to use their personal phones for this. Should not mix work and private data, and this should be in the interest of the corp, too. As in, issue work phones!
If it is just TOTP, you can use any other TOTP app, such as Aegis or FreeOTP+.
And no, Microsoft cannot be trusted on not doing anything bad. The app is full of trackers and has an excessive list of permissions it "requires".
For comparison, Aegis and FreeOTP+ work without trackers and way less permissions.
Microsoft has a long track record of leaks. Just naming the 2 most prominent:
Maintain a veil of separation between personal and business. Just say you can't install it.
They must then provide you with needed hardware.
Just say you don't have a smartphone....you have a flip phone...doesn't matter.
And don't fall for the argument that companies require ties also, they can require cell phones..... Not at all same thing.
Just say you don't have a smartphone....you have a flip phone...
Recently looked into this, pretty much 100% of currently-available flip phones are still smartphones under the hood, running either Android or KaiOS. And you can still install apps on these phones.
The only truly “dumb phone” appears to be the Rotary Un-Phone, or a vintage feature phone from the early 2000s that boots straight from ROM - instant-on, no visible boot process whatsoever.
≥ and force Microsoft Authenticator on the (private) phones of both employees and volunteers.
Refuse to use the service until they provide you with a work appointed phone. Volunteers admitedly have a more difficult time with that but as someone else said you can indeed do text/call options.
a work appointed phone
With all the tracking that comes with it.
Not much of a privacy risk if it where used for a dedicated purpose and just left off in a drawer otherwise though. My employers pushed the notion of MS authenticator, but left the options to use regular TOTP available, just had to look a bit to find them. Even if they absolutely forced corp software though, a cheap wifi-only setup device is a viable option.
Who cares? It's a work phone that is used only for work, they are entitled and expected to track it as much as my work laptop or any other company equipment. That's not a privacy issue unless you're using company resources for personal stuff. If I don't want them tracking me I just turn it off or leave it at home.
yes? use it solely for work purposes, at work, turn it off when you clock out...
your employer is not your friend.
Agreed. From a privacy perspective, it is a lot safer to run the app in an environment where you have admin control. E.g. disable when not in use, block access to sensitive device information, limit background and network activity as much as possible.
I work for a global company and help manage MFA for everyone...I use Google's authenticator on my personal phone as they didn't give me a work phone.
I still don't understand why a hardware token isn't being used. It's such a low cost option when compared to buying a phone and plan for a user.
Because you can’t call someone on a hardware token.
you should really use FreeOTP+ instead. https://f-droid.org/en/packages/org.liberty.android.freeotpplus/
Is your company mandating Push Authentication or are you entering 6-digit codes?
If it's the former, MS Authenticator is the only option.
If it's the latter, you can use any TOTP app you like, e.g. Aegis.
Afaik, Microsoft’s OTP implementation is proprietary and not TOTP.
But also, my understanding is you can select which MFA schemes you can use, and allow SMS, MS MFA, and TOTP.
Source: employer used to allow sms, locked it down, and totp apps can’t parse the MS authenticator QR codes.
Not true. Work at an MSP that has hundreds of Microsoft accounts in our password managers with TOTP. We even migrated password managers and had no issues with TOTP.
That said, we are moving away from shared admin accounts and we will have delegated access enabled with JIT for better security soon.
Im using aegis as totp with microsoft at my company right now
It might depend on configuration. In the only case of Microsoft enforced 2FA I know of, it is just TOTP. Microsoft's web interface nudges (tries to trick) you into using the MS Authenticator app, but that app is not needed. You can use any TOTP capable 2FA app, e.g. Aegis or FreeOTP+, both of which are also available through F-Droid and don't require internet connection.
If they want you to use a specific application they need to provide you with everything that is needed for you to run said application.
Just ask whether they can provide a phone as well.
The whole point of MS Auth is that it tracks your location, so if you get a 2nd phone they still track you but you now carry around 2 phones.
You can say no, and if they won't budge buy a cheap old phone off Swappa or craigslist or marketplace for $20 install Ms authenticstor on it and leave it at your desk.
What do you have against ms authenticator?
I put the stupid app on my phone.
Never use your own personal phone for work related stuff.
If they want you to use a phone-based app, ask them to help you install it, then bring in an early-2000s feature phone that boots straight from ROM, no Android or KaiOS under the hood.
As in, force the company to get you a company phone.
Never use your own personal phone for work related stuff.
As someone who does this, my main issue is now I am carrying around two phones. This is a daily annoyance for me.
My next round I think I am going to drop the work phone and use Androids profile options. Setup a work profile on my personal phone and just use that. Then just have work reimburse me for my personal phone/plan.
I won't allow any MS stuff on any of my devices.
I work for an MSP servicing 5k users all of whom I force to use M$ Auth app. Because it is the best Authenticator on the market, their company is paying for it, and because I look at the sign in logs for 3-4 different organizations every day to see literal hundreds of foreign sign-in attempts that fail due to M$ MFA. Yeah fuck monopolistic megacorps but understand when they provide an actual good product that is safe to use and actively protects you as an individual better than anything else out there.
All that said, the most likely reason is that they don't want to make a document explaining how to set up MFA for each of the dozen+ apps out there and they certainly don't want to talk to users who don't know what they are doing with which ever app their kid set up for them
I'm sure you know what you're doing better than 80% of the other employees in your office in this regard but I can tell you from experience, when one person gets their way, everyone wants theirs too.
You left out two things:
You can use Aegis and/or Yubico Authenticator instead, that's what I do.
They said that the option to use other authenticators were disabled by their company
In my company at least, Aegis works for the first few logins, but it will keep nagging you have to switch to Microsoft's authenticator and you're locked out after a while.
Unless it turns out that only the supid MS one works on that specific company.
You're wasting your life trying to fight battles you don't even understand.
Is there any valid reason why they would do this, like it’s demonstrably safer? Or is this a battle I can pick to shield myself a little from MS?
Thanks for the input?
There's no "battle" here. It's their phone, end of discussion. They don't need to justify to you or anyone what they do and do not want on it.
What you don't understand is that a worker does not need your permission or approval to exercise their right to control their personal property, and that right far exceeds any concerns about how easy the IT admin's job is.
Or is this a battle I can pick to shield my self from ms
Read the post before coming to the comments to reply.
OP is asking on here about whether or not to pick this battle and fight his company over it. Yes, you are probably technically correct that a company can't force you to install an authenticator app on your phone. However, that is a battle that you will have to fight with them that will accomplish essentially nothing if you win.
In Canada right now there is a major auto manufacturer that is being sued by the union over this very issue. It is a years long legal case that had to be escalated through the union, it's lawyers ,and now arbitration. Does that not sound like a battle to you?
I don't really get the rub here, JM all for separating work devices and personal devices but the 2fa apps don't leak any info and the company can't "do" anything to your phone remotely. The apps work in air plane mode. I also want to bet more than half the users that complain about this use the companies free WiFi.
Get a flip phone and say you can't install it, however SMS 2fa is very insecure.
The apps work in air plane mode
They're talking about Microsoft Authenticator, not any MFA. It doesn't work on airplane mode if they require number matching.
also want to bet more than half the users that complain about this use the companies free WiFi.
...and? The wifi isn't installed on their phone, the fuck does that matter?
In my case they didn't disable the option to use any authenticator for 2FA.
So I just use another one.
I don't see why forcing MS Authenticator will be better than any other authenticator.
The person who forces it is for sure not a security expert.
It will be easier to hackers to hack 2FA when they know what the authenticator app is, versus hundreds of different authenticator clients.
I'm also not a fan of MS spyware.
But in defence of the MS authenticator, the 2FA prompts it sends are very convenient, how they pop up and ask for the number displayed on screen, its definitely more secure than just the one time code.
Plus it also shows what phone the user is using when they install and configure the authenticator app, this is also very useful if you suddenly see the user accessing their mail or one drive from another mobile device.
How would MS Authenticator make it any better than TOTP?
To break TOTP, the attacker would need to:
a) be able to observe the initial exchange of the TOTP secrets. To do that, the attacker needs access to the victim's computer (on user level) at that specific time they set up TOTP. TOTP is a TOFU concept and thus not designed to protect against that. However, if the attacker controls the victim's computer at that time, the victim is screwed anyways even before setting up 2FA.
b) have access to the TOTP app's secret storage and to the victim's login credentials (e.g. by phishing). If the attacker can gain that level of access, they would also have access to the Microsoft Authenticator's secret storage, so there is no benefit of the Microsoft app.
On the other hand, Microsoft Authenticator is a very huge app (>100MB is huge for an authenticator app, Aegis is just 6MB, FreeOTP+ 11MB), i.e. it brings a large attack surface, especially by connecting to the internet.
I don't think Microsoft Authenticator brings security benefits over a clean and simple TOTP implementation.
It will be easier to hackers to hack 2FA when they know what the authenticator app is, versus hundreds of different authenticator clients.
Security through obscurity is not security.
Additionally, any method that generates a code locally that needs to match the server will not be secure if you can extract the key used locally. Yes you can argue that more users makes a juicier target, but I’d argue that Microsoft has the resources spend reducing the chance of an exploit and the resources to fix it fairly quickly. Much more so than any brand new team.
The default authentication option for the company I work for is that a code is displayed in the screen of the device I’m logging into AND a push notification is sent to the Authenticator app, the app then prompts me to enter the code from authenticating device. To break that you’d need the username, password, a clone of the phone/device used to authenticate (or the original), and the user’s PIN for that device (MS Authenticator requires this to complete the authentication.)
Yes MS Authentication services do sometimes go down, and yea it can impact my ability to work
I am by no means a MS fanatic, but I’d trust them for mission critical authentication over something like Authy.
Thanks people, some good replies here. I could demand a work phone, but that's impractical, dragging around two phones etc. I'd like all my 2FA in Aegis and not have to think and pick the right app first, let alone pick and unlock the right phone. The Shelter option is very nice, didn't know about that. If my company won't budge I'm doing that. When push comes to shove I could even use outlook that way on my phone.
It's worth adding I greatly prefer MS Auth style authentication, since I don't have to find the right entry to read the Auth code and then write it on the other computer. Instead MS pops a notification and you either type or select the right number, verify with fingerprint and done. Much more convenient.
It often tells you what you login into and where you are attempt to log in from, so it's a few extra layers of security for those that have that awareness to check those details.
Get a used /cheap phone or tablet, only turn it on or enable wifi when you need the app. Don't use it for anything else. I think that covers all the bases.
Declare yourself a member of The Church of Emacs and claim your religious rights are being violated.
While it’s not technically safer, MS does make it a lot easier to set policy’s where you check a box for MSAuth.
Since the config is less complex and easier, it’s demonstratably safer to implement it this way.
This could indeed be a valid reasoning. I'm going to investigate a bit. If you can easily cough up some MS documentation page on this topic please do
I managed to get around the MS auth app and am using aegis right now.
You can just use FreeOTP
My company has the same policy
If you're in the US, that could very well get you fired in any "at will employment" state. It's shitty, fucked up, and should be illegal, but the legislators seem to represent wealthy corporations way more than they represent their human constituents (GOP especially).
Authentication methods in Entra ID (which is presumably what we are talking about as the identity provider) include Microsoft Authenticator and software otp.
Authenticator is push authentication, as described elsewhere here. If for some reason you're not getting push notifications, you can use an OTP code instead, but this still requires that you have push authentication configured in Microsoft Authenticator.
You can only use Software OTP in other applications if your administrator has explicitly allowed use of Software OTP as an authentication method, and also excluded you from being required to use Authenticatior - otherwise Authenticatior would always 'win' as choice of mechanisms because it is more secure.
Several states in the USA require that employees who are made to use their personal phone for business purposes be compensated. The enforcement method and process for requesting same is naturally very obscure.
Grab the shelter app from f Droid, add the Play store in shelter, move over to the work side Play store and install the authenticator.
Pause your work apps except for when you need to use the authenticator.
Prosper???
Alternatively, in a similar fashion. Use "hail" to auto pause any app you want so they don't run in the background unintended.
Lots of great conversation here, I also work somewhere where this is required. If I didn't need my phone for access to chat, I just wouldn't use it for work. Alternatively, my phone has a work profile so I use that for any work related or non-FOSS apps. My IT guy even approved of my methods and said do the minimum and never more with tech.
I used bluestack to emulate android and us MS Auth when I had no choice.
It's a waste of space, but it doesn't go on your phone at least
We let anyone use any authentication app. The Microsoft one is the best one. I'm pushing to make us exclusive because I'm sick of the IT support guys trying to support a dozen apps. You don't have to use your Microsoft account provided to use the app or back up your credentials.
I’m pushing to make us exclusive because I’m sick of the IT support guys trying to support a dozen apps.
While I understand this... Why not just refuse to support and NOT remove the capability for all those who don't need support and work just fine with their own? It's not like TOTP isn't a solved problem at this point.
Eg. "we only support MS auth, If you choose to use your own you will not receive any company support."
As a security enthusiast, please also push for allowing physical security keys. They are awesome.
As a cryptography nerd, +100000 to that
Upvote for providing an explanation, though I personally favour employee freedom.
Is Microsoft Authenticator available on Linux?
It's on Android, but
Ms auth is a mobile only application. Not even available on windows or macOS. The point of it is to provide a second factor of authentication in the for of "something you have". There are a few factors that can be used for authentication. Something you know (password), something you have (hardware like a key or a phone), and something you are (iris scan, DNA, fingerprint, other biometric). Ms auth uses something you have and something you are to authenticate most users. You provide a password and then you prove you have your cellphone and your cellphone checks your biometrics to see if you are you. In that way, it is effectively checking all 3 factors.
If MS Authenticator still works with totp urls just like any other authenticator then you can just use some open source authenticator. Some password managers even have one built it.
If your company is enforcing geographic location as a security qualifier then MS Authenticator can poll your device. Also you can use push authentication with the MS suite.
What is your concern about installing MS Authenticator.
I mean I can understand the principle of being forced to install anything on your phone.
But just stepping into the practical for a second: What do you worry will happen by installing this app to your phone?
200 MB of wasted personal disk space just so you can log in to a work account
Ok, but most workplaces require some form of apps installed for access, shared documents etc.
How many would install Figma, Office, Expensify, Jira, Confluence or a whole other raft of work apps if it wasn’t for work?
I mean, sure, it’s annoying but is MS Authenticator really the hill people want to die on?
I'm not concerned per se and I definitely applaud the MFA requirement. I mean I hate MS and don't like apps I don't need, and I don't trust them, but as others pointed out this would mostly just be whiny. That's why I asked for reasons why restricting users to MS Authenticator would be preferable. If it's more secure or technically way easier and thus cheaper to maintain then fine, I'll find an acceptable way to comply. If not, then it's them who are whiny and I'd rather make the case to let us use whatever authenticator we already have installed.
But MS Authenticator isn’t a normal 6-digit Authenticator; it scans your Face ID (or finger print) and in many cases (like my work) it can be support password less accounts (relying only on something you have and something you are).
And in regard to your point that you don’t want to install apps you don’t need, it sounds like you do in fact need this app.
🤷♀️
reasons why restricting users to MS Authenticator would be preferable
As a security professional:
If your workplace is leaning heavily on the Microsoft ecosystem, especially their cloud offerings like Azure, then restricting employees to the Microsoft app is a no-brainer, and actually quite reasonable.
For example, if they happen to have a hybrid domain with an on-prem domain controller syncing with Azure (forgive me for using obsolete terms, I’m a greybeard), then they can control all access to all company assets, including 2FA. If an employee leaves the company, they can also disable the Microsoft app at a moment’s notice by disabling the employee’s Microsoft account. Because everything is hooked into Azure, it sends push notifications down to all company assets - like the Microsoft 2FA app - to unhook all of the company’s credentials and prevent employee access after the fact.
You cannot do this with other 2FA apps.
I'm guessing they never mentioned that it tracks your location? That's why they insist on using it not any of the other bullshit.
AFAIK on Android it has a hard dependency on Google services. I don't mind installing proprietary stuff to my work profile for the express purposes of work but that requires modifying my system to accommodate this specific app and that's a step too far for my personal device. So I use a free software option (Aegis) instead.
edit: if for some reason I really did need MS Authenticator and not any old TOTP app, I would procure a googled device specifically for work rather than install google or microG into my personal device.
And here I am wishing they would come out with an authenticator watch app, so I didn't have to do all the work of taking my phone out of my pocket and swiping a few times.
Your employer might use MS Authenticator but still let you do call or SMS 2FA. If you use a VOIP number, it won't be vulnerable to SIM card swapping attacks.
SMS auth is going away, it is not considered secure in the last few environments I have worked in
SMS auth is going away,
OP is looking for an alternative to MS Authenticator. If this works as an alternative temporarily, they may still consider it worth it.
[I]t is not considered secure in the last few environments I have worked in
Yes, SMS 2FA is usually not secure due being vulnerable to SIM card swapping attacks, that's why I explicitly recommended using a VOIP number, which would not be vulnerable to SIM card swapping attacks.
At what point can you tax deduct your phone as a business expense?
You can't just have microsoft text you a code? That's what I do
That's the solution I picked at work. Refused to install that Microsoft software on my personal phone, but instead provided a phone number.
If you have a VoIP provider you could even try to the VoIP number for MFA instead of providing your real mobile number.
If IT make a comment about you not having the app, ask if they intend to provide a company device for that.
You have the right not to use your personal hardware for work, and the employer must provide the necessary equipment to accomplish your job.
Ask if you could get a hardware token (ie: Yubikey Security Key) instead of using Microsoft Authenticator to fulfill the security requirements. It's low cost and doesn't require a subscription unlike a cellphone plan.
You have the right not to use your personal hardware for work, and the employer must provide the necessary equipment to accomplish your job.
Reputable Source?
At least in Quebec:
Employers’ Responsibilities Towards
These are the main ones:
- Employers must give their employees a place to work and make sure they have access to it. They must give them the tools, equipment and other things they need to do their work.
https://educaloi.qc.ca/en/capsules/rights-and-responsibilities-of-employers-and-employees/
...it won't let me edit my other comment but I wanted to add that YES using MFA is demonstratively far more safe than any password you can set.
With a multi factor enabled you could literally give your password out and people could not access your account without being able to complete that second layer of security.
He said he wants to use mfa, but a normal generated token instead of the Microsoft one.
If you don't care about the money you get paid every fortnight then go ahead. Nobody cares! For employers , you are just a number and for you ,employer is the means to get paid.
If you don't need the money then fuck it.
we have o365 and while i do have the authenticator, you should also be able to add a phone number or email address for text/email codes instead of the authenticator (i know my coworker doesn't have the authenticator but gets codes to her sms)
Do like a friend of mine. He has a 15 dollar a month phone(mint mobile) that he uses for all his job related bullshit. Its all it does and he has no personal accounts on it at all. It kinda sucks that they insist on him using his own equipment for it but its the cheapest way to keep them out of his personal life.
Would you even need a monthly plan for this kind of thing? It just needs to be able to install the app and run it. If it needs internet you can connect to WiFi. You can get a sim free android for about £50 outright now.
I guess if there is WiFi, he won't even need a mobile data plan, so he could safe lots of money.
When setting up the authentication when it asks you to set up Microsoft authenticator there should be a drop-down at the bottom of the page that says use another option that will allow you to use a phone call or text message as your chosen method of authentication.
This can be configured for the Microsoft tenant. The admin can allow all possible MFA vectors or restrict it to just a single one such as the Microsoft Authenticator. Microsoft themselves are also pushing the Authenticator, which is actually fine. I haven’t done any packet captures to see what it is sending back to Redmond, but the most secure method is great. The service you are logging into generates a two-digit number that you must enter when prompted in the Authenticator app.
Still, I’ve seen issues arise when an employee only has a flip phone or flat out refuses to install any app required for work on their personal devices. IT departments will typically fold to pressure and allow a call or text for MFA because they did not want to buy, configure, and send out phones to employees refused.
I’ve also seen IT send a company phone to a specific user that refused to allow Microsoft to have their phone number for calls or texts too. Legal told them they could not require the employee to use their personal property or reveal personal details to Microsoft in order to work.
^ This. We try to enforce Microsoft Authenticator company wide and we will never be able to completely ditch call/text as an option. We have a ton of users that don't have smart phones. We have a policy to only allow call/text if a user specifically requests it.
I know Google has a way to "force" you to only use their app, and that's strictly enforced for personal MFAs (I haven't verified that recently), I didn't have that kind of trouble not using the MS one, but I'm not sure my org was as strict as yours on that "force MS" option.
I am in IT and I feel like I speak for the industry we don't care. Some of my customers have regulators who make arbitrary and capricious decisions with a minimal understanding of infosec but we have to keep the customer compliant.
I had to install MS Authenticator to get into my account, then I added a phone number. I then deleted Authenticator from my phone and from my 2FA settings.
I'm in the same boat. Had to repurpose an old android device as a authenticator.
Or you could use an android VM.
Same problem here, my company requires 2FA for remote network access. MS Authenticator requires Google Services on Android which I don't have - so no home office for me I guess.
when you get the prompt at my work their is an option that says you don't have your phone on you and it leads to the old way of doing it.
During the enrollment you can tap on the option to use another method and have it send you a text code instead of using the app.
SMS is inherently insecure as a MFA, consider using aegis for your TOTP codes instead.
Not if the company has disabled sms for mfa as they should have.
You might be able to 2FA via text or phone call. That's what I do. It's bad enough I have to BYOD for a laptop. I don't want MS BS on my personal phone as well
For 2FA? You can use any 2FA just make backups
The post says that the admins disabled the use of all others.