Cloud backup and recovery for the Microsoft Authenticator app on Android now available

Hi JonasBack, the backup is secured with your personal Microsoft account credentials. So yes, if someone can login to your account, and also successfully complete two step verification for your account, they can restore your backup on any device.

Right now, there aren't immediate plans to enable backup for Microsoft work accounts, because we need a mechanism for admins to turn cloud backup off. However, we are currently working on a mechanism to allow admins to enforce other settings, like "App Lock". Admins won't be able to enforce settings through App Protection Policies. When we did the investigation, we found it didn't make sense to go that route, because some of the Intune App Protection Policies conflicted with Authenticator. For example, through APP, you could require MFA to open an app, but Authenticator is your mechanism for MFA, and so you get into a chicken-and-egg scenario. Instead, there will be a way to apply settings specifically to control the behavior of Authenticator.

Awesome! Can you explain a little more on how the backup is secured? For example, if someone can login using your Microsoft (Personal) Account, will they be able to get the backup restored to any device they want?

Also, what are the plans to enable backup to Microsoft Work Account (that is Office 365/Azure AD account), even though I realize this can present a catch 22 scenario.

Any plans to have these settings managed using Intune App Protection Policies so we can enforce settings, for example disable/enable this feature including ”App Lock”?

Olena Huang thank you for the detailed response. Really well summarised and I only wish that more feedback like yours (level of detail) is provided when launching new features and capabilities. Great content. Thanks again.

CthulhuTactical the backup is stored with Microsoft on Android. (On iOS, it's stored with iCloud). Because of security reasons, it's not accessible anywhere except the Microsoft Authenticator app, so you can't make a local backup to a usb drive at this time. Thanks for the feedback.

Hi solmssen , sorry for your trouble. We currently don't back up the O365 accounts because we want to let admins decide if the end user is allowed to back up the account. We are working on giving admins the capability to manage the app right now. Once we have that, we can turn on backup for O365 accounts.

Olena Huang Could you clarify what you mean with that you don’t backup Office 365 Accounts? 

I have around 40 Office 365 (Azure AD) accounts in my iOS Authenticator (different customers, different tenants) and soon switching phone. Are you saying these accounts will not be restored when I switch to the new phone?

JonasBack Yep, not real backup. If you have a personal Microsoft account set for backup, what you’ll get is the personal account will come back, and the list of your Azure AD accounts will come back but each one won’t work until you show it a QR code from the MFA set up screen on that account. I just did it with 14 accounts, I don’t envy your 40. 

Great feature. I was hoping for this feature for so long. Thank you for delivering this 

JonasBack thanks for your feedback. Going forward, we probably will keep the backup tied to the personal Microsoft account. End users shouldn't have to back up all their personal accounts to OneDrive for Business, as we make the promise that their admin won't get access to their personal credentials. However, for security minded customers, we definitely want to give the option to block the feature completely for work/school accounts, if they don't feel the user's personal Microsoft account/iCloud aren't properly secured.

Having just been through a phone upgrade, I can tell you that this was a GIANT pain. I have 14 Office 365 accounts and a personal MS account setup in Authenticator and it took me at least two hours to get them all back up and running, and it would have taken even longer if I hadn't still had the old phone. The personal MS account restored from backup, and the Office 365 accounts still all needed to be reshown QR codes, which meant logging into the account, etc. People change phones, they do it a lot, and it needs to be easier than this.