FIPS 140 compliant for Azure AD authenticationīeginning with version 6.6.8, Microsoft Authenticator for iOS is compliant with Federal Information Processing Standard (FIPS) 140 for all Azure AD authentications using push multi-factor authentications (MFA), passwordless Phone Sign-In (PSI), and time-based one-time passcodes (TOTP).Ĭonsistent with the guidelines outlined in NIST SP 800-63B, authenticators are required to use FIPS 140 validated cryptography. When two methods are required, users can reset using either a notification or verification code in addition to any other enabled methods. To ensure the highest level of security for self-service password reset when only one method is required for reset, a verification code is the only option available to users.

Users view the notification, and if it's legitimate, select Verify. The Authenticator app can help prevent unauthorized access to accounts and stop fraudulent transactions by pushing a notification to your smartphone or tablet. To get started with passwordless sign-in, see Enable passwordless sign-in with the Microsoft Authenticator. This authentication method provides a high level of security, and removes the need for the user to provide a password at sign-in. When the correct number is selected, the sign-in process is complete. Instead of seeing a prompt for a password after entering a username, a user that has enabled phone sign-in from the Authenticator app sees a message to enter a number in their app. Instead, users can register their mobile app at or as part of the combined security info registration at. Users don't have the option to register their mobile app when they enable SSPR.

Microsoft account authenticator setup