So my company decided to migrate office suite and email etc to Microsoft365. Whatever. But for 2FA login they decided to disable the option to choose “any authenticator” and force Microsoft Authenticator on the (private) phones of both employees and volunteers. Is there any valid reason why they would do this, like it’s demonstrably safer? Or is this a battle I can pick to shield myself a little from MS?

  • @sunbeam60
    link
    625 days ago

    What is your concern about installing MS Authenticator.

    I mean I can understand the principle of being forced to install anything on your phone.

    But just stepping into the practical for a second: What do you worry will happen by installing this app to your phone?

    • Fleppensteyn
      link
      fedilink
      English
      1025 days ago

      200 MB of wasted personal disk space just so you can log in to a work account

      • @sunbeam60
        link
        725 days ago

        Ok, but most workplaces require some form of apps installed for access, shared documents etc.

        How many would install Figma, Office, Expensify, Jira, Confluence or a whole other raft of work apps if it wasn’t for work?

        I mean, sure, it’s annoying but is MS Authenticator really the hill people want to die on?

        • Fleppensteyn
          link
          fedilink
          725 days ago

          Yeah but you install that stuff on your work computer. If my job requires me to use an authenticator on a non-work phone, then at least let me use the one I’m already using.

    • @Martin@lemmy.mlOP
      link
      fedilink
      425 days ago

      I’m not concerned per se and I definitely applaud the MFA requirement. I mean I hate MS and don’t like apps I don’t need, and I don’t trust them, but as others pointed out this would mostly just be whiny. That’s why I asked for reasons why restricting users to MS Authenticator would be preferable. If it’s more secure or technically way easier and thus cheaper to maintain then fine, I’ll find an acceptable way to comply. If not, then it’s them who are whiny and I’d rather make the case to let us use whatever authenticator we already have installed.

      • @sunbeam60
        link
        725 days ago

        But MS Authenticator isn’t a normal 6-digit Authenticator; it scans your Face ID (or finger print) and in many cases (like my work) it can be support password less accounts (relying only on something you have and something you are).

        And in regard to your point that you don’t want to install apps you don’t need, it sounds like you do in fact need this app.

        🤷‍♀️

        • lemmyvore
          link
          fedilink
          English
          124 days ago

          Biometrics are only needed for passwordless login, not for TOTP.

      • @rekabis@lemmy.ca
        link
        fedilink
        425 days ago

        reasons why restricting users to MS Authenticator would be preferable

        As a security professional:

        1. Under most situations, it is equally as good as any other 2FA app.
        2. Within the Microsoft ecosystem, it provides additional security features above and beyond simple 2FA.

        If your workplace is leaning heavily on the Microsoft ecosystem, especially their cloud offerings like Azure, then restricting employees to the Microsoft app is a no-brainer, and actually quite reasonable.

        For example, if they happen to have a hybrid domain with an on-prem domain controller syncing with Azure (forgive me for using obsolete terms, I’m a greybeard), then they can control all access to all company assets, including 2FA. If an employee leaves the company, they can also disable the Microsoft app at a moment’s notice by disabling the employee’s Microsoft account. Because everything is hooked into Azure, it sends push notifications down to all company assets - like the Microsoft 2FA app - to unhook all of the company’s credentials and prevent employee access after the fact.

        You cannot do this with other 2FA apps.

        • Saik0
          link
          fedilink
          English
          225 days ago

          This is disingenuous though… You can simply reset the TOTP seed on any account to achieve the same operation. We use AuthLite on a local domain… I can disable an account domain-wide by simply resetting the TOTP seed or disabling the account. Using an Azure domain and MS app doesn’t add any value in that regards. All of the online office stuff can be linked onto a local domain as well and would also be disabled.

          • lemmyvore
            link
            fedilink
            English
            124 days ago

            You don’t even need to disable an ex-employee’s ability to generate TOTP codes… Once the account is disabled what use are the codes?

            • Saik0
              link
              fedilink
              English
              1
              edit-2
              24 days ago

              Well that’s a bit of the point of my post… why are you making it out like disabling the 2fa app matters?

              Edit: Swype typos!

      • lemmyvore
        link
        fedilink
        English
        224 days ago

        I’m guessing they never mentioned that it tracks your location? That’s why they insist on using it not any of the other bullshit.

      • @sunbeam60
        link
        124 days ago

        Not really. It checks your location when you authenticate. It doesn’t store the location.

        • lemmyvore
          link
          fedilink
          English
          124 days ago

          I don’t care whether it stores the location. The problem is that it sends it to your employer. And so do all Microsoft apps. Teams for example makes full reports for managers to peruse about all kinds of information taken from each employee’s device, including location and whether they were using the device and when.

    • Captain Beyond
      link
      fedilink
      2
      edit-2
      25 days ago

      AFAIK on Android it has a hard dependency on Google services. I don’t mind installing proprietary stuff to my work profile for the express purposes of work but that requires modifying my system to accommodate this specific app and that’s a step too far for my personal device. So I use a free software option (Aegis) instead.

      edit: if for some reason I really did need MS Authenticator and not any old TOTP app, I would procure a googled device specifically for work rather than install google or microG into my personal device.