Do Microsoft Security Defaults Require the Authenticator App?
Question details
Users need to know if the Microsoft Authenticator app is strictly mandatory when Microsoft Security Defaults are enabled on their account, or if other MFA methods are supported.
- Product
- Microsoft 365 / Azure AD
- Device & OS
- not provided
- Scenario
- Setting up or managing multifactor authentication (MFA) after Microsoft Security Defaults have been activated for a tenant.
- Observed behavior
- Users receive prompts to set up MFA via Microsoft Authenticator and are unsure how to select alternative verification options like SMS or security keys.
Ensure you have the login credentials for your Microsoft account and access to the alternative verification devices (like a mobile phone for SMS or a FIDO2 security key) you intend to register.
Selecting an Alternative Verification Method During Setup
While Microsoft Authenticator is the recommended method, you can often bypass it by choosing a different available verification option during your initial MFA setup.
Microsoft security defaults require multifactor authentication, but the exact methods available depend on your tenant policies, region, and account configuration. Alternatives can include SMS, voice calls, FIDO2 security keys, or Windows Hello.
Log in to your Microsoft account. If security defaults are enabled, you will be greeted by a 'More information required' screen. Click 'Next'.
On the 'Keep your account secure' screen, instead of downloading the Authenticator app, locate and click the 'I want to set up a different method' link at the bottom left.
A drop-down menu will appear. Select an alternative such as 'Phone' (for SMS or voice call) or 'Security key' (for FIDO2 devices), then click 'Confirm'.
Follow the on-screen instructions to register your chosen method, such as entering the code sent to your phone number via text message.
Enjoy Hassle-Free Productivity with WPS Office
If navigating complex Microsoft 365 tenant policies, security defaults, and mandatory authentication apps is complicating your personal or small business workflows, consider switching to WPS Office. It provides a straightforward, user-friendly environment without complex enterprise-level account administration.
- 1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the installation package and follow the quick setup wizard to install the suite on your device.
- 3. Open your documents: Launch WPS Office and instantly open, edit, and save your existing Microsoft Office files without formatting loss.
Frequently Asked Questions
Why am I getting a Microsoft tenant security notice as a home user?
If you previously signed up for certain Microsoft services like Teams Free or a developer account using your personal email, Microsoft automatically generated a 'tenant' (an organizational directory) for you in the background. Security defaults are now being applied to all tenants by default.
What is Authenticator Lite?
Authenticator Lite is a feature that allows users to complete multifactor authentication directly within the Microsoft Outlook app on their iOS or Android mobile devices. It acts as an alternative to downloading the standalone Microsoft Authenticator app.
Can I disable Microsoft Security Defaults entirely?
Yes, if you have global administrator rights for the tenant. You can disable it by logging into the Microsoft Entra admin center (formerly Azure AD), navigating to Properties, clicking on 'Manage security defaults', and toggling it to 'Disabled'. However, Microsoft highly recommends keeping it enabled to protect against identity attacks.
