On iOS, if Microsoft Authenticator Installed, Microsoft Outlook forces authenticator use

Question

On iOS, if Microsoft Authenticator Installed, Microsoft Outlook forces authenticator use

Calvin Nelms 5

All, we are having a strange issue.

On iOS, if a user has the Microsoft Authenticator app installed and they either sign into the Microsoft Outlook app with their o365 account or add a new account to the Microsoft Outlook app, the next step forces you to sign into Microsoft Authenticator app to add their account.

We do not want to utilize Microsoft Authenticator as we utilize DUO for 2FA.

We have disabled Microsoft Authenticator Campaign in Azure Entra ID, but the problem still occurs.

The only fix we have found is to remove the Microsoft Authenticator app completely. After it is removed, if we add or sign into the o365 account in the Microsoft Outlook app, DUO 2FA kicks in.

Any thoughts for a solution? I posted this question here and an agented recommended posting in this forum.

Shawn Collins 610 Reputation points

2024-04-13T02:08:08.2933333+00:00

Conditional access? Are the devices managed by Intune? If Intune, policies are 'tattooed' on devices, so removing the app makes sense. If it is Intune, you'd have to created another policy to exclude and add all devices to your scope.
Calvin Nelms 5 Reputation points

2024-04-15T12:24:12.06+00:00

Conditional access and Intune are not involved here. These are personal devices. I verified they are not listed within the Microsoft Intune list.
Calvin Nelms 5 Reputation points

2024-04-15T12:25:37.0333333+00:00

Conditional access and Intune are not involved here. These are personal devices. I did verify they are not listed within Intune.
Catherine Kyalo 1,935 Reputation points Microsoft Employee

2025-05-26T18:49:05.0933333+00:00
This behavior seems to be tied to device registration and passwordless sign-in flows. When Microsoft Authenticator is installed:

Outlook may attempt to register the device with Entra ID.

This triggers Authenticator’s passkey or device trust setup, even if DUO is your MFA provider.

This is why removing Authenticator prevents the prompt—it removes the default handler for that registration flow.

Your answer

Shawn Collins 610 Reputation points

2024-04-13T02:08:08.2933333+00:00

Conditional access? Are the devices managed by Intune? If Intune, policies are 'tattooed' on devices, so removing the app makes sense. If it is Intune, you'd have to created another policy to exclude and add all devices to your scope.
Calvin Nelms 5 Reputation points

2024-04-15T12:24:12.06+00:00

Conditional access and Intune are not involved here. These are personal devices. I verified they are not listed within the Microsoft Intune list.
Calvin Nelms 5 Reputation points

2024-04-15T12:25:37.0333333+00:00

Conditional access and Intune are not involved here. These are personal devices. I did verify they are not listed within Intune.
Catherine Kyalo 1,935 Reputation points Microsoft Employee

2025-05-26T18:49:05.0933333+00:00

This behavior seems to be tied to device registration and passwordless sign-in flows. When Microsoft Authenticator is installed:

Outlook may attempt to register the device with Entra ID.

This triggers Authenticator’s passkey or device trust setup, even if DUO is your MFA provider.

This is why removing Authenticator prevents the prompt—it removes the default handler for that registration flow.

Share via

On iOS, if Microsoft Authenticator Installed, Microsoft Outlook forces authenticator use

Your answer