Home

Authenticator Phone Sign-In for Office 365 Work Accounts?

%3CLINGO-SUB%20id%3D%22lingo-sub-229086%22%20slang%3D%22en-US%22%3EAuthenticator%20Phone%20Sign-In%20for%20Office%20365%20Work%20Accounts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229086%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20the%20Microsoft%20Authenticator%20setup%20for%20both%20my%20personal%20Microsoft%20account%20and%20have%20been%20testing%20it%20with%20our%20new%20Office%20365%20work%20account%20that%20we%20just%20set%20up.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20personal%20account%20was%20setup%20with%20Phone%20sign-in%20where%20instead%20of%20a%20password%20it%20shows%20you%20a%20selection%20of%203%20numbers%2C%20you%20chose%20the%20one%20that%20is%20shown%20on%20the%20login%20window%2C%20use%20your%20pin%2Ffingerprint%20and%20it%20signs%20you%20in%20without%20a%20password.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20work%20one%20uses%20the%20traditional%20one%20where%20you%20enter%20your%20password%20and%20it%20then%20asks%20you%20to%20approve%20it%20on%20the%20mobile%20device.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20noticed%20that%20I%20could%20set%20up%20Phone%20Sign-In%20for%20my%20work%20account%20in%20the%20authenticator%20app%2C%20after%20doing%20so%20it%20seems%20as%20if%20nothing%20has%20changed.%20It%20still%20asks%20me%20for%20the%20password%20everywhere%2C%20and%20gives%20me%20the%20traditional%20approve%2Fdeny%20message%20in%20the%20app.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAm%20I%20doing%20something%20wrong%3F%20I%20didn't%20see%20any%20setting%20that%20seemed%20to%20allow%20or%20deny%20the%20use%20of%20phone%20sign%20in%20inside%20the%20exchange%2Fazure%20admin%20panel%20settings.%20My%20account%20is%20already%20set%20to%20enabled%20for%20multi%20factor%20(or%20it%20wouldn't%20be%20working%20at%20all)%20and%20I%20can't%20seem%20to%20find%20any%20other%20information%20about%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20found%20a%20microsoft%20doc%20page%20that%20said%20it%20was%20possible%20and%20listed%20the%20steps%20for%20work%20or%20school%20accounts.%3C%2FP%3E%3CP%3EI've%20done%20everything%20on%20the%20authenticator%20app%20side%20that%20it%20mentioned%2C%20but%20nothing%20has%20changed%20on%20the%20login%20side.%20Not%20inside%20the%20email%20web%20login%20or%20with%20logging%20into%20office%20apps%2C%20both%20work%20to%20prompt%20the%20newer%20phone%20sign-in%20when%20I%20use%20my%20personal%20credentials%20instead.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-229086%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAuthentication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-290373%22%20slang%3D%22en-US%22%3ERe%3A%20Authenticator%20Phone%20Sign-In%20for%20Office%20365%20Work%20Accounts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-290373%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20sure%20if%20you%20managed%20to%20solve%20this%2C%20but%20did%20you%20do%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1%3A%20Open%20PowerShell%20in%20admin%20mode%3C%2FP%3E%3CP%3E2.%20Run%26nbsp%3BInstall-Module%20-Name%20AzureADPreview%20-AllowClobber%3C%2FP%3E%3CP%3E3.%20Connect-AzureAD%26nbsp%3B%3C%2FP%3E%3CP%3E4.%26nbsp%3BNew-AzureADPolicy%20-Type%20AuthenticatorAppSignInPolicy%20-Definition%20'%7B%22AuthenticatorAppSignInPolicy%22%3A%7B%22Enabled%22%3Atrue%7D%7D'%20-isOrganizationDefault%20%24true%20-DisplayName%20AuthenticatorAppSignIn%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnce%20this%20is%20done%2C%20then%20enable%20phone%20sign%20on%20the%20authenticator%20app.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-229181%22%20slang%3D%22en-US%22%3ERe%3A%20Authenticator%20Phone%20Sign-In%20for%20Office%20365%20Work%20Accounts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229181%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20not%20yet%20possible%20to%20do%20this%20with%20Azure%20AD%2FOffice%20365%20accounts.%20But%20it's%20coming%2C%20as%20part%20of%20the%20whole%20buzz%20around%20%22passwordless%20login%22.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-229175%22%20slang%3D%22en-US%22%3ERe%3A%20Authenticator%20Phone%20Sign-In%20for%20Office%20365%20Work%20Accounts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229175%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20full%20admin%20access%20and%20for%20the%20life%20of%20me%20can%20not%20find%20any%20setting%20that%20has%20anything%20to%20do%20with%20restricting%20different%20kinds%20of%20MFA%2C%20just%20enabling%20or%20disabling%20it%20entirely%20per%20account.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20Microsoft%20docs%20on%20this%20don't%20seem%20to%20touch%20on%20any%20changes%20that%20need%20to%20be%20made%20on%20the%26nbsp%3Badmin%20side%26nbsp%3Bfor%20environments%20where%20the%20older%20password%2Fauthorization%20MFA%20was%20already%20working.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20is%20something%20that%20is%20admin%20set%20I%20would%20really%20love%20to%20know%20where.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-229169%22%20slang%3D%22en-US%22%3ERe%3A%20Authenticator%20Phone%20Sign-In%20for%20Office%20365%20Work%20Accounts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229169%22%20slang%3D%22en-US%22%3E%3CP%3Eit%20Could%20be%20that%20your%20admin%20has%20predefined%20the%20way%20you%20should%20use%20MFA.%20Which%20basicly%20means%20you%20can%20not%20change%20it%20to%20the%20app.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

I have the Microsoft Authenticator setup for both my personal Microsoft account and have been testing it with our new Office 365 work account that we just set up.

 

My personal account was setup with Phone sign-in where instead of a password it shows you a selection of 3 numbers, you chose the one that is shown on the login window, use your pin/fingerprint and it signs you in without a password.

 

My work one uses the traditional one where you enter your password and it then asks you to approve it on the mobile device.

 

I noticed that I could set up Phone Sign-In for my work account in the authenticator app, after doing so it seems as if nothing has changed. It still asks me for the password everywhere, and gives me the traditional approve/deny message in the app. 

 

Am I doing something wrong? I didn't see any setting that seemed to allow or deny the use of phone sign in inside the exchange/azure admin panel settings. My account is already set to enabled for multi factor (or it wouldn't be working at all) and I can't seem to find any other information about this.

 

I found a microsoft doc page that said it was possible and listed the steps for work or school accounts.

I've done everything on the authenticator app side that it mentioned, but nothing has changed on the login side. Not inside the email web login or with logging into office apps, both work to prompt the newer phone sign-in when I use my personal credentials instead.

 

Thanks!

4 Replies
Highlighted

it Could be that your admin has predefined the way you should use MFA. Which basicly means you can not change it to the app.

I have full admin access and for the life of me can not find any setting that has anything to do with restricting different kinds of MFA, just enabling or disabling it entirely per account.

 

The Microsoft docs on this don't seem to touch on any changes that need to be made on the admin side for environments where the older password/authorization MFA was already working.

 

If this is something that is admin set I would really love to know where.

Highlighted

It's not yet possible to do this with Azure AD/Office 365 accounts. But it's coming, as part of the whole buzz around "passwordless login".

Highlighted

Not sure if you managed to solve this, but did you do the following:

 

1: Open PowerShell in admin mode

2. Run Install-Module -Name AzureADPreview -AllowClobber

3. Connect-AzureAD 

4. New-AzureADPolicy -Type AuthenticatorAppSignInPolicy -Definition '{"AuthenticatorAppSignInPolicy":{"Enabled":true}}' -isOrganizationDefault $true -DisplayName AuthenticatorAppSignIn

 

Once this is done, then enable phone sign on the authenticator app.