Work

Some organizations require authenticator; they don't just use it for MFA codes, it's goes deeper than that.

Also, most large enterprise fall for the stupid Microsoft trap. They buy enterpise licensing in bulk (E3, E5, whatever) and bosses who have no brains will say "well, let's use more microsoft products since they're 'free'". The trap is that, yes, your enterprise license agreement includes entitlements to a lot of their stuff, but they nickle and dime you on stupid shit like the storage so you can keep the logging and telemetry data you typically need for security, troubleshooting and some audit requirements.

I can't imagine ever using any of their shit beyond Office products. Their security software is crap compared to most offerings, they still seem to think that networks are bad so we should do as little as possible about them. Azure is just a completely uncontrollable money drain (by design) that is damn near impossible to secure properly once you give developers enough access to actually do their jobs.

I've been working in security for a long time now and they continue to be such a fucking liability and drain on money at every turn. If I ran the zoo, I would switch the entire enteprise to Linux and find just about any other collaboration suite to use.

Fuck Excel and fuck you if all you do with it is make lists. Fuck powerpoint and fuck every boss who is too dumb to read and only can accept information when it is spoon fed to them in a deck. Word is OK, but nobody reads anymore so what's the point?

I had to use it for my work. They required MS authenticator. I think it's bullshit and tried to export my 2fa to bitwarden. I couldn't. And to add another 2fa .method I need to call support so I gave it up

I had a yubikey as my hardware authentication, then a coworkers email got hacked so IT moved us all to Microsoft authenticator, so now I have a less secure login method LOL

When you are using your phone for your work you don't really have the choice.

Yup, I use Aegis, and found a strange little trick with Bitwarden Authenticator where I can import them into the main app (the Vaultwarden server). I know keeping all my power in one place defeats the purpose of 2FA but you know, I trust Vaultwarden, and myself to keep it secure, implicitly.

This change is really more about enterprise use cases. If you take DLP seriously you need to make sure the integrity of the controls on work provided devices are intact. Authenticator isn't managed by intune since users could use it for many things.

Nothing stops someone taking a photo of another screen. It's not a panacea. It's just one more hurdle.

people likely using workday as for a job probably, or any app that uses MS.

Yes. I also switched to Aegis.

Yubikey.

Yeah that's my choice too bc it offers access from my desktop browser too, not just the mobile app. Tying accounts to a single device makes me uncomfortable.

Its why they had to announce this, the venn diagram of microsoft authenticator users and degoogled android is likely two circles

Probably Play Integrity, since it's still working on my phone with the Play Integrity Fix Magisk module installed.

Any app can tell if it has root privileges.

2FA is not just for work.

I wont use my personal phone for anything work related except authentication. Since it sits in its own little jail, it's fine.

I work all over the world and remote in. I have no other work related devices or equipment.

I look at it as a key card from the old days when I had to go into a building. I think that is a pretty trivial use case and doesn't need them to provide a phone, and in fact I absolutely would not want a device owned by anyone else that I carried around. That is FAR worse.

That said, this change sucks as I will now need to get around this bullshit.

you don't just use authenticator for work. anybody who plays Minecraft uses it.

Does it even support OTP?

Just use https://github.com/beemdevelopment/Aegis on Android.

KeePassDX Android does. Been using it for a while now.

https://en.wikipedia.org/wiki/IOS_jailbreaking

yep. it's sort of dead right now but not completely. in fact, a new bootrom exploit for Xs/11 era devices got released recently, and 11 is still getting supported on latest iOS 27.