App for mobile devices offering one-time codes, push notifications that use number matching, and passwordless sign-in by phone.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Authenticator in context, with comparison tables and the common traps.
Terms in this definition
- App protection policy
A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.
- Real-time streaming semantic model
Covers live-fed push, streaming and PubNub models, plus streaming dashboard tiles. Microsoft now steers people towards Real-Time Intelligence in Fabric, as these are being retired and new ones can only be made until 31 October 2027.
- Number matching
Feature of Authenticator push notifications requiring users to enter the number displayed on the sign-in screen. It is now mandatory for every push notification.
Related terms
- Additional context (Authenticator)
Microsoft Authenticator option that enriches push and passwordless prompts with where the sign-in is coming from geographically and which application asked for it.
- Broker app
Without one, app-based Conditional Access can't work, since it's what registers phones and tablets in Entra ID. iPhones and iPads use Microsoft Authenticator; Android devices can use Company Portal or Authenticator.
- Device-bound passkey
A passkey tied to one physical device, such as a FIDO2 security key or Microsoft Authenticator, which generates its private key and never lets it leave. Synced passkeys work differently, with a passkey provider copying them from device to device.
- Passwordless authentication
Replaces the password with a device you own plus a PIN or biometric; examples include passkeys, Microsoft Authenticator and Windows Hello for Business.
- Passwordless phone sign-in
Mode of Microsoft Authenticator, switched on for a target group in the Authentication methods policy, that lets users sign in with no password.
- Registration campaign
Nudges people who have just completed an interactive MFA sign-in to add a passkey or Microsoft Authenticator push notifications. You pick a single method per campaign and decide how many times users may postpone.