So my company decided to migrate office suite and email etc to Microsoft365. Whatever. But for 2FA login they decided to disable the option to choose “any authenticator” and force Microsoft Authenticator on the (private) phones of both employees and volunteers. Is there any valid reason why they would do this, like it’s demonstrably safer? Or is this a battle I can pick to shield myself a little from MS?

  • federalreverse-old@feddit.de
    0·
    7 months ago

    Is your company mandating Push Authentication or are you entering 6-digit codes?

    If it’s the former, MS Authenticator is the only option.

    If it’s the latter, you can use any TOTP app you like, e.g. Aegis.

    • RecallMadness@lemmy.nz
      0·
      7 months ago

      Afaik, Microsoft’s OTP implementation is proprietary and not TOTP.

      But also, my understanding is you can select which MFA schemes you can use, and allow SMS, MS MFA, and TOTP.

      Source: employer used to allow sms, locked it down, and totp apps can’t parse the MS authenticator QR codes.

      • asim0v@lemmy.world
        0·
        7 months ago

        Not true. Work at an MSP that has hundreds of Microsoft accounts in our password managers with TOTP. We even migrated password managers and had no issues with TOTP.

        That said, we are moving away from shared admin accounts and we will have delegated access enabled with JIT for better security soon.

        • RecallMadness@lemmy.nz
          0·
          7 months ago

          Ok. Did a quick read. And I think I mixed my words a little.

          Yes, Active Directory supports TOTP fine.

          But my understanding is rollouts can disable TOTP, and instead force the use of the proprietary scheme requiring the MS Authenticator app (which also supports TOTP) that uses push notifications to the device.

          As is the case with my employer. They didn’t enable TOTP, and I am unable to use the provided MFA QR code with 1Password.

          • asim0v@lemmy.world
            0·
            7 months ago

            When you start the MFA registration process for a Microsoft account and select the Authenticator as the method there is a link at the bottom of the page about using a different app. Sure it will only generate a rotating code instead of the “easier” method of just entering a 2 digit number when prompted on the phone, but entering 6 numbers isn’t that much more difficult than 2.