Microsoft Authenticator is Microsoft’s free app for two-factor authentication on Android, iPhone and iPad. It generates one-time codes for any service and approves sign-ins to Microsoft personal and work or school accounts. It is reviewed here on the same five criteria as every other app in this section, as a point of reference rather than a recommendation.

Most of this review is about the backup. Without it, your secrets stay on the phone and Microsoft has no copy, but a lost phone means setting up two-factor login again at every site. With it, per Microsoft’s description, the secrets are encrypted with a key that the app gets from Microsoft, so Microsoft holds the key to the copy; on iPhone the current help pages do not say whose key it is.

Secret Custody & Recovery

Each account you add holds a seed secret: whoever has it can produce your codes without your phone. On Android, until you turn on Cloud Backup in the app’s settings, these secrets stay on the phone; on iPhone the copy goes to iCloud once several iCloud settings and the app’s own switch are on, and Microsoft does not document whether that switch starts on.

Microsoft described how the backup works in a 2019 post on its Entra blog. The app requests a 256-bit key from “an internal Microsoft account key service”, encrypts your accounts with it, including the secrets behind time-based codes, and uploads the result. To restore, the 2019 design has the app sign you in and fetch the same key from Microsoft’s key service again; the current iPhone restore page asks for no sign-in. You never set a password for the backup, and there is no option to encrypt it with a key only you hold, so key custody for the copy stays with Microsoft. Microsoft does not say that it reads these backups, but its design gives it the key to decrypt them.

Where the backup goes depends on the phone. On Android, you choose a Microsoft personal account to store it, and Microsoft’s help page says that from January 2027 the Android backup will move to Google One backup instead. On iPhone and iPad, the backup goes to your iCloud account once iCloud Drive, iCloud Keychain, iCloud Backup and the app’s own switch in the iCloud settings are all on. Microsoft’s current help pages do not say whose key protects the iPhone backup. A backup made on Android cannot be restored on an iPhone, or the other way round, and work or school accounts are never backed up: only their names come back, and you have to sign in and register them again.

Restoring works through the account that holds the backup: your Microsoft personal account on Android, your iCloud account on iPhone. If you lose access to that account, you cannot restore the backup. Without a backup, Microsoft’s help page offers one path: add every account again. The app has no export, so you cannot keep a copy of your own outside Microsoft’s or Apple’s cloud. If you have not set up another way to sign in to those sites, that means going through each site’s own account recovery.

On the phone, App Lock asks for your device PIN or biometrics when the app opens and when you approve a sign-in. Microsoft says it is on by default once the phone has a PIN or biometrics set up, and adds that it is no guarantee that someone cannot reach the app.

Account & Metadata Privacy

Codes for other services are added by scanning the service’s QR code, without signing in to Microsoft, so the app works for them without an account (account-less use). A Microsoft personal account is needed for push sign-in to that account and, on Android, to store the backup.

Microsoft’s FAQ says the app collects basic usage data, such as whether important operations succeed or fail, and that you accept this when you first open the app; Microsoft describes no setting to turn it off. More usage data is shared only if you turn on the Usage Data switch. Diagnostic logs leave the phone only when you send feedback. The app asks for your location only when an employer’s or school’s policy requires it.

The store declarations go further. On the App Store, Microsoft lists precise location, email address, user ID, device ID, product interaction and diagnostic data as data that may be linked to you, used among other things for analytics. Google Play lists less: precise location as optional, and approximate location and other user content shared with third parties for app functionality. Both are the developer’s own statements, not checked by Apple or Google. This telemetry is separate from the codes, which are generated on the phone and work without an internet connection.

Transparency & Verifiability

The app and the service that stores Android backups are closed source. Without the code, nobody outside Microsoft can check how the app stores the secrets on the phone or what it sends during backup; the description of the backup design is Microsoft’s own.

Microsoft publishes no security audit of Microsoft Authenticator. Its identity bug bounty covers the Android and iPhone apps, with rewards from $375 to $100,000.

The app is published by Microsoft Corporation of Redmond, Washington, a publicly traded US company. Microsoft’s privacy statement names Microsoft Corporation as the controller of personal data, and Microsoft Ireland Operations Limited for people in the European Economic Area, the United Kingdom and Switzerland. Microsoft says it discloses personal data when required by law or valid legal process and publishes a report on law enforcement requests. On Android, Microsoft holds both the backup and the key to it, so both are within reach of a legal request to Microsoft.

Security Vulnerabilities in 2026

Microsoft published three security advisories for the app in 2026. Microsoft marked none of them as exploited or publicly disclosed before the fix. Its descriptions name a one-time sign-in code, a sign-in link or sign-in tokens as what could be exposed, and none mentions the stored secrets; each needed the user to act on a malicious app or request. Microsoft also published one advisory for the app in 2024.

March 2026 (CVE-2026-26123). If a malicious app was installed on the phone and the user picked it to open a sign-in link, for example after scanning a QR code, that app could receive a one-time sign-in code or the sign-in link. Microsoft rated it Important and fixed it in iOS version 6.8.40 and Android version 6.2511.7533.
May 2026 (CVE-2026-41615). A request made to look legitimate could make the app obtain a sign-in token for the user’s work account and send it to the attacker once the user approved it. Microsoft rated it Critical and fixed it in iOS version 6.8.47 and Android version 6.2605.2973.
September 2026 (CVE-2026-80097). On Android, a malicious app on the phone could obtain sign-in tokens if the user completed a sign-in in Microsoft Authenticator. Microsoft rated it Important and fixed it in Android version 6.2606.4246.

Microsoft also says it retires older versions of the app, which then stop working until they are updated.

Usability, Portability & Platforms

Microsoft Authenticator runs on Android and on iPhone and iPad with iOS 17 or later; Microsoft says there is no version for Windows or Mac. It generates time-based codes (TOTP) for any service that offers them, including without an internet connection, and lets you approve sign-ins to Microsoft personal and work or school accounts with a tap. For work or school accounts it can also hold a passkey that never leaves the phone it was created on.

New accounts are added through a standard setup QR code or by typing the key. The app has no export: no file, no transfer QR codes, no standard link per account. If Microsoft stopped supporting the app, the only way to move your codes would be to set up two-factor login again at each site. The backup only moves codes to the same app on the same kind of phone, and one set of codes is not kept in sync across several phones.

Microsoft’s FAQ says the password autofill feature was discontinued in mid-August 2025, and the browser extension that came with it was retired on 14 December 2024. The app now covers codes, sign-in approvals and, for work or school accounts, passkeys.

Funding & Sustainability

Microsoft Authenticator is free, with no paid tier, no in-app purchases and no ads. The App Store lists about two updates a month in 2026, and both store listings show updates in October 2026. The app earns nothing on its own: Microsoft pays for it as part of its sign-in products for personal and work accounts. Its future depends on Microsoft’s plans, which have already removed password autofill from the app and will change where Android backups are stored in January 2027.

Pros and Cons

Free, with no ads and no paid tier, and updated about twice a month
Codes for other services work without a Microsoft account
On Android, backup is off until you turn it on, and App Lock is on by default once the phone has a PIN or biometrics
Sign-in approvals for Microsoft personal and work or school accounts
Microsoft's identity bug bounty covers the Android and iPhone apps

Per Microsoft's description, the backup is encrypted with a key Microsoft holds, with no option to use your own
No export of any kind, so without the backup a lost phone means relinking every site
A backup made on Android cannot be restored on an iPhone, or the other way round
Closed source, with no published security audit
Basic usage data cannot be switched off, and the App Store declaration lists location and IDs linked to you
Three security advisories in 2026, including one Microsoft rated Critical
No desktop app

Our Rating

Secret Custody & Recovery3.5/10
On Android, until you turn on Cloud Backup, the secrets stay on the phone, and App Lock asks for your PIN or biometrics by default. Per Microsoft's 2019 description, the backup is encrypted with a key the app gets from Microsoft's key service, so with backup on Microsoft holds the key to the copy, and there is no option to use a key of your own; the current iPhone pages do not say whose key protects the iCloud copy. Without the backup, a lost phone means setting up two-factor login again at every site, because the app has no export either.
Account & Metadata Privacy4.0/10
Codes for other services work without a Microsoft account. Microsoft requires basic usage data that cannot be switched off, and its App Store declaration lists location, email address, user and device IDs and usage data linked to you. Extra usage data is optional.
Transparency & Verifiability3.0/10
The app and the backup service are closed source, and Microsoft publishes no security audit of the app. Microsoft's identity bug bounty covers the Android and iPhone apps with rewards of up to $100,000. In 2026 Microsoft published three security advisories for the app, none marked as exploited. Microsoft Corporation is a US company.
Usability, Portability & Platforms4.5/10
Apps for Android, iPhone and iPad, with time-based codes for any service and sign-in approvals for Microsoft accounts. There is no desktop app, no export of any kind, and a backup made on Android cannot be restored on an iPhone or the other way round.
Funding & Sustainability6.5/10
Free, with no ads and no paid tier, and updated about twice a month. The app earns nothing on its own, and Microsoft has already removed password autofill from it and plans to move the Android backup to Google One backup in January 2027.

Overall4.0/10

Secret Custody & Recovery 30% · Account & Metadata Privacy 20% · Transparency & Verifiability 20% · Usability, Portability & Platforms 20% · Funding & Sustainability 10%

See our rating methodology →