MS Authenticator account settings

Question

Can MS Authenticator accounts be shared by different devices, e.g., laptop, phone, and tablet

Answer 1

As Bruce Weiszmann notes in his answer above, the authentication secrets aren't shared across devices, since they're stored in special secured areas within each device like the TPM for Windows 10/11 devices or the Google Android equivalent of the Titan M, a hardware security module integrated into certain Android devices, such as the Pixel series, which provides secure storage for cryptographic keys and enhances device security.

Since those modules aren't designed for two-way access and instead verify the data presented to them by the PC, phone or other device in which they're contained, it's not possible for those secrets to be shared externally, so that makes syncing functionally impossible, since that avenue would obviously be abused by malware and utterly destroy the very security these modules were designed to provide.

Instead, the current direction that both Microsoft and other organizations like Google are taking is the implementation of Passkeys, since the Fast IDentity Online 2 (FIDO2) open standard upon which passkeys have been built makes them resistant to phishing and other issues that the cryptographic secrets used by the authenticator and stored in the TPM aren't.

For this reason, Microsoft’s Edge browser can now be used to create and sync passkeys across devices. The browser’s built-in password manager can currently sync passkeys across Windows PCs, but support for more platforms is coming soon, though Microsoft for Android [or IOS] currently does not have a specific date for passkey support.

This is the direction I would suggest you'd be better off taking, especially once these additional platforms gain support for passkeys. because all of the major vendors including Google and Apple, along with most major websites already support this more modern and open standards-based system, as well as are working quickly to support the syncing and potentially even sharing of these more resilient shared secrets across devices and operating systems.

If you have a Windows 10 or 11 device with Windows Hello Face, Fingerprint and/or PIN, then you're already using a passkey to login to your Microsoft account, since that's how Windows supports this silent connection to your account in the background. It's the act of also using them to support connection to your other external accounts typically via the browser that makes them slightly more visible, though since by their nature, they're more streamlined and automatic, they're only really visible when the websites you're accessing require to you select them as part of the authentication process.

Rob

Answer 2

Microsoft Authenticator does not work as a shared configuration between devices. Installing the app on a new device and signing in with the same Microsoft account does not automatically replicate the existing MFA accounts from another device.

Each device needs to be separately registered and populated with the required accounts. If backup and restore is enabled, some accounts can be recovered on a new device, but this is not a live synchronization mechanism and some account types (for example work/school accounts with additional registration requirements) may need to be re-registered.

For security reasons, the authentication secrets are not simply mirrored across devices. Each device maintains its own cryptographic keys and registration state.

Answer 3

Yes, the same account can be registered with Microsoft Authenticator on multiple devices. For example, a user can have the same account configured on both a phone and a tablet.

Answer 4

Superb responses! Love long answers to short questions!

Answer 5

Yes, laptop, iPhone iPad