Authenticator app

Question

I have 3 organisations registered on my Authenticator app but only one displays the 6 digit code. When I go to sign in on the other 2, it takes me to a page with a 2 digit code and asks me to open my Authenticator app to enter the 2 digit code to sign in. But I am already in the app and I cannot see where to enter the code

I want this set up so that when I click on the organisation I get the 6 digit code without having to sign in again - it has already done face recognition!

Answer 1

There are two different ways Microsoft Authenticator can work:

• Six-digit code: You open the organisation's entry and read a time-based code. You then enter it on the sign-in page.
• Number matching: The sign-in page displays two digits, and you approve the sign-in through an Authenticator notification by selecting or entering the matching number. This helps protect against someone approving an unexpected sign-in.

Regarding the six-digit codes, work or school accounts can have different authentication methods depending on the organisation's configuration. Open https://mysignins.microsoft.com/security-info and check whether you can add or configure the Authenticator app for verification codes.

If that option isn't available, contact your organisation's IT administrator to confirm whether verification codes are permitted.

Don't remove your existing accounts until you've confirmed that another sign-in method works. Face ID unlocks the app, but it doesn't automatically enable six-digit codes for every account.

Microsoft's guide: https://support.microsoft.com/en-gb/authenticator/sign-in-using-microsoft-authenticator

Answer 2

The two-digit number must be entered through the New sign-in request notification, not by opening the organization’s account tile; a six-digit code appears only when that organization has separately enabled and registered the verification-code method.

Complete the current two-digit sign-in

1. Leave the page displaying the two-digit number open.
2. On the phone, pull down the notification panel and tap New sign-in request from Microsoft Authenticator.
3. Unlock Authenticator with Face ID, fingerprint, or the device PIN if requested.
4. Enter the two-digit number shown on the sign-in page, then tap Approve.

If Authenticator is already open, temporarily switch away from it and tap the Authenticator notification. The number-entry box is part of that pending notification, not the organization tile. Microsoft documents this as number matching, which is enabled for Authenticator push notifications and cannot be opted out of while using that method.^1^ The standard sign-in sequence is to open the notification, enter the displayed number, and approve.^2^

Face recognition only unlocks Authenticator; it does not approve the pending sign-in by itself.

Set up a six-digit code, if each organization permits it

Authenticator supports both push notifications and OATH verification codes, but they are distinct authentication methods.^3^ For each of the two organizations:

1. Sign in to that organization’s Security info page.
2. Select Add sign-in method.
3. Select Microsoft Authenticator and then Add.
4. Continue until a QR code appears.
5. In Authenticator, select + → Work or school account → Scan a QR code.
6. Complete the setup test.
7. At the next sign-in, select Other ways to sign in → Use a verification code, if offered.
8. Open that organization’s Authenticator entry and enter its rotating six-digit code.

These are the documented work/school account registration steps.^4^ Each organization controls which sign-in methods are available, so the six-digit option might not be offered even though another organization uses it.^5^

Do not remove the existing Authenticator entries until the replacement method has been tested; doing so could lock you out.

If no Authenticator notification appears

If the two-digit page remains open but there is no notification or number-entry screen:

• Select Other ways to sign in and use another method already registered for that organization.
• If no alternative works, contact that organization’s IT administrator and ask them to reset or require re-registration of your Authenticator method. After the reset, register the account again by scanning the organization’s new QR code. Re-registration is the applicable recovery when the existing registration no longer produces the required Authenticator prompt.^6^

---

References

1. How number matching works in MFA push notifications for Authenticator - Authentication methods policy
2. Sign in using Microsoft Authenticator | Microsoft Support
3. Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
4. How to add your accounts to Microsoft Authenticator
5. Sign in to your work or school account using two-step verification | Microsoft Support
6. Microsoft authenticator: Cambie de dispositivo y no aparece apartado para el código de acceso a dos pasos de mi sitio de trabajo. - Microsoft Q&A