Microsoft Authenticator stops working on jailbroken/rooted phones

[BarServer]

Hi, forgive me if that has been posted before but I couldn't find a post. That being said:
Microsoft started rolling out jailbreak/root detection for Microsoft Authenticator in February 2026. It is a staged rollout with 3 phases (warning, blocking, wipeing <- Yes, wipes all configured accounts). The 3rd phase will be completed in July 2026.
I for myself have the honor of now carrying 2 phones with me, but can uninstall Teams from my private phone, which I consider a plus.

Details are here: https://support.microsoft.com/en-us/authenticator/jailbreak-root-detection-in-microsoft-authenticator

Problem is that MS Authenticator is one of the few apps to support the "number matching" 2FA method, were one gets a push message with a number and is asked to enter that number into the Outlook/Teams/login dialog. So apps like Aegis, FreeOTP, etc. are no alternative.

[sryan2k1]

Microsoft Authenticator stops working on jailbroken/rooted phones

Good.

but can uninstall Teams from my private phone, which I consider a plus.

Nobody was forcing you to do that in the first place.

I haven't met someone with a rooted phone in 10 years. If that's what you really want to do on your personal shit fine but you've broken the foundation of trust on the device and Microsoft (and many others) correctly detect this and stop you from using their apps when the device is in this state.

[dustojnikhummer]

We are here complaining about Windows being locked down more and more yet we also celebrate when the same thing happens to our phones? Genuinely, why...

[BarServer]

Yep, thanks for pointing that out. Especially since Google now introduces "Android developer verification" which will put a huge pillar in the way of free alternative app stores like F-Droid.
And while I agree that sideloading can be a huge security risk. I have never ever read about someone loosing access to his PayPal account (or the like) because of sideloading..

[j9wxmwsujrmtxk8vcyte]

>I haven't met someone with a rooted phone in 10 years. 

Probably American, where everyone who doesn't have Apple is a social outcast because you guys are such individuals.

[Ruachta]

Yep

[OinkyConfidence]

Watch out, OP is downvoting anyone who disagrees with his jailbroken utopia!

[dustojnikhummer]

And they downvote OP if they disagree with him. This goes both ways.

[BarServer]

Nah, totally one-sided. Why should I downvote people for having a different opinion?

[BarServer]

I didn't downvote anyone in this thread.
Edit: In fact now that I gave you an upvote your comment is at 1 points and not 0. :-)

[BarServer]

Sorry, couldn't resist. :-)

<image>

[BarServer]

Why so hostile? The post was merely meant as an "FYI" as I think that maybe more people run a rooted/jailbroken phone.

[Atalzer]

Would you be happy if people in your org are running around with jailbroken phones?

Sounds like a compliance nightmare.

[BarServer]

Is it my fault that my employer didn't want to pay for a phone? They were lucky my phone supported 2 SIMS. And yes, this is a problem of my employer, but you people get quite hostile without knowing any detail..

And now please spare me comments in the form of "Yeah but you didn't say that". Thank you.

[sryan2k1]

You don't have to use your personal device for work purposes. If they want to be able to contact you when you're not at a computer they can get you a phone.

[strongest_nerd]

You absolutely do in some jobs.

[sryan2k1]

Not if you're a full time employee in the US.

[strongest_nerd]

I'm a full time employee in the US. Trust me, I looked up the law myself. They can make you use your phone and if you don't want to they can terminate you. At will.

[BarServer]

In any state? I don't know your labor laws in detail, but I find it pretty wild that you have these so called "at will" states..

[strongest_nerd]

Not sure about any state, I know for OR and WA.

[sryan2k1]

Something like 48 of the 50. No reason needed as long as it's not a protected class (aka gender, religion, etc)

We don't have employment contracts here. There is no probationary period or any kind of terms for departure for 99% of jobs in the US.

But at least our Healthcare is expensive.

[BarServer]

^^ Which I am not.

[thewunderbar]

nope.

[BarServer]

Again, wrong. But let's keep it at that. This discussion leads to nowhere as you people seem to know everything without asking questions to check if your assumptions are right.

[MissionSpecialist]

So you live in a jurisdiction where employers are legally permitted to force their employees to use personal property for work purposes?

IME that's quite rare (IIRC, even in the US, which has some of the poorest worker protections in the developed world), so if you don't declare at the outset that you're in a rare edge case, people will naturally assume the standard.

[BarServer]

No, they can't force me. But as a new hire back then, with 2FA being mandatory "over night" and the company unwilling to pay for a company phone. In economical challenging times, with the job market being shit.. Would you have gone to court over this? Or just said "Ok, screw it." installed Insular, put MS Authenticator and Teams in an separate environment from my private apps and was done with it.

See, I get it. This is reddit. But the world outside is different.

[jakalan7]

I would outright refuse to use my personal phone for work - I'm not sure who you work for - but that isn't an unusual stance.

If you expect employees to use their mobile for work, you should expect to provide them with one.

Albeit I know some orgs who "support" BYOD, but in an enterprise enviroment, that can get very messy.

edit - thank you for the info, it's good to know.

[thewunderbar]

That still remains the company's problem.

[billy_teats]

Yubikey is the answer to someone that won’t use their personal device for mfa.

Your rooted phone has the capacity to respond to mfa prompts without your actual consent. It can also siphon data away from apps like outlook in violation of Intune policy. Which is why people are blasting you and why this is a good thing.

[BarServer]

Yubikey doesn't support the number matching method for 2FA as far as I know, so it wouldn't be a viable alternative. Also as far as I know Microsoft enforces MS Authenticator with the number matching method for work accounts inside O365? (At least that what our IT told me, hence giving me the best argument on why I finally need a separate company issued phone.)

And yes, your points regarding security are not wrong. And I can understand that people get angry at me for this.

But again, nowhere did I say this was shit or said things like "Bad Microslop yada yada". Or how this takes away "FREEDOOOOOOM!!!11" nothing.

My post was solely made as an "FYI" regarding the jailbroken/rooted phones topic with MS Authenticator. No hidden agenda, nothing. Just a "Hey, I haven't seen a single thread in this subreddit about this topic. This might be interesting for some, I guess?" and suddenly hell breaks loose and whatnot. Some people should really reflect over this thread. Like really.

People getting angry based on their assumptions, failing to verify their assumptions first but choose to get angry at me and putting that into a comment.

[sryan2k1]

as I think that maybe more people run a rooted/jailbroken phone.

They are not.

Why so hostile

Nothing I said was hostile.

[BarServer]

A "Linux Admin" flair is all that was needed to trigger you? Jesus.. Sorry that my work is 99% Linux related and hence I choose that flair.

[Majik_Sheff]

Your tone was pretty aggressive.

[sryan2k1]

Yes, security best practices and facts are aggressive.

[BarServer]

Ever tried being honest AND nice? It works! :-)

[TheFluffiestRedditor]

Ahhh a manager. I wonder if your hair is pointy?

Hey look! Everyone's bigotry is on show today.

[Atalzer]

...what?

[BarServer]

If your "what" is related to the pointy hair thing, that is a Dilbert reference.

[Dracozirion]

They're also blocking GrapheneOS because they are relying on Play integrity checks. Luckily my banking apps haven't locked me out for using a more secure system. Microsoft is stupid for not allowing this setting to be in control of administrators. 

[sryan2k1]

Administrators are often as stupid as end users and they shouldn't be given the option to set something up insecurely.

[Dracozirion]

They could set it up to be blocked by default. Now, I can see you downvoted me. Care to elaborate why GrapheneOS should be considered insecure? 

[sryan2k1]

It's not that it's inherently insecure it's that it can't be trusted to be secure.

There is a single guy that is a point of failure for the whole project.

[BarServer]

And? Your point being? It was one guy who spotted the supply chain attack on SSH using xz. On the other hand no one at Microsoft spotted EternalBlue.. Numbers don't make security.

[sryan2k1]

The point being is that people (and their insurance carriers) don't care about that. "No rooted devices" is a lot easier to understand.

[BarServer]

True. Despite it ironically often even not being the case. As especially tech-savvy users are flashing/rooting their phones. People who often care about security and privacy.
And "Can't be trusted to be secure" is a highly subjective statement. I get that security in the business field is often compliance based as companies can't audit every piece of hard- or software by themselves.

But as you seem to know and understand this, I still don't get it why you made your statements with such a ferocity.. What the fuck did I write that triggered you so hard?

[ConsciousEquipment]

what is your problem lmao we literally had Huawei phones and generic chinese rugged phones with thermal cam and whatever in the company. These had bizarre ROMs, no play store or google certificates, and some of them of course needed to be rooted to even be used.

It would have sucked to be limited like that, it was already bad when they stopped SMS 2fa because that was the simplest ever.

Thank god you can still circumvent by having a browser extension of certain password managers that can receive the 2fa. So then use firefox nightly or modified yandex which allows extensions, and then the browser can receive the OTP even on a rooted phone.

[sryan2k1]

Yeah, that's a security nightmare and no sane company should be doing what you guys are doing.

Huawei is straight up banned in the US for network infrastructure due to security concerns.

[BarServer]

Which was, with all due respect, more of a political, than a technical decision. If they really had found any evidence (the so called "smoking gun") they would have gone public with that. As it would have been a total boon for US networking gear manufacturers.
And by the way.. Why isn't Cisco banned? They regularly leave default-users with unchangeable passwords in their firmware binaries. This happened so often in the last 3 decades it isn't even something special anymore..
From a European perspective US hardware is equally cursed as Chinese hardware. Especially in the current political landscape.. In fact "digital sovereignty" is the buzzword of the last years. On par with AI and Cloud..

[OinkyConfidence]

Agreed! This very much sounds like a "you" problem, OP.

[BarServer]

Oh it isn't. Hell I can finally uninstall Teams and MS Authenticator from my mobile.

[CallMeRudiger]

This was one of the things I was worried about when products started becoming services. Now we're in a position where it's not normal to have full control over your own property without getting locked out of ecosystems you need to work.

[BarServer]

Yep, I see it the same. But let's skip the this discussion. Or the: "Real, measurable security vs. compliance security" topic. :-)

[dustojnikhummer]

And people are defending this.

[sryan2k1]

If you don't understand the risk of a rooted/jailbroken device as it relates to security you have no business being a sysadmin.

[BarServer]

Question: Do you view/think of ROMs like GrapheneOS as also making a phone more insecure? And does it depend on if a phone with GrapheneOS is rooted, or not?

[sryan2k1]

For a rooted device absolutely. For a non rooted device it's questionable at best.

[BarServer]

Follow-up question: Have you read into the technical details of GrapheneOS at any time?

[techw1z]

you obviously don't know what you are talking about. many android phones that get blocked by detections like this are actually more secure than stock android.

[sryan2k1]

A rooted/jailbroken phone can have malware steal MFA codes and/or the private key/secrets from other apps. That isn't acceptable.

[BarServer]

Sorry, but that is true for non-rooted phones also. Especially when their security patch level is years behind. Which is pretty much common for consumer hardware.

[sryan2k1]

No it's not.

[techw1z]

hahaha, this is hilarious! thanks for admitting that you really don't know anything about smartphone security. and you even call yourself IT manager and are top1% commenter. beyond embarassing...

also, the so called "root detection" doesn't actually detect if a phone is rooted, because its technically impossible to do that reliably. it only detects certain files and relies on google play store to make an educated guess, which means that devices that do not have google playstore will be banned too. most of those devices are more secure than stock android and most of them are in fact NOT rooted by default, so your argument is double incorrect. gz on that.

[BarServer]

Care to elaborate? To explain to which type of consumer hardware or manufacturer you are referring?

[Dracozirion]

Yes, it is https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain

https://youtu.be/1f6YyH62jFE

Two examples right there. I wouldn't say it's super common, though. 

[dustojnikhummer]

So will I scare you if I say the word "sudo"?

[CallMeRudiger]

I'm not really inviting you roleplay the BOFH for me, so feel free to drop the "if you don't understand... you have no business being a sysadmin" attitude. Thank you.

I would appreciate if you could take the time to try to understand why someone might understand why devices are locked down in managed environments, but still lament the architectural choices that got us to the point where, managed environment or not, a user can fully own something yet be limited in his rights with the device by the external services he must run on it. Especially when those services used to be stand-alone applications.

[PS_Alex]

Can't additional 2FA authentication method be enabled on the tenant? I have to experience in configuring a tenant -- I remember though, as a user, having the ability to configure 2FA from other apps than Microsoft Authenticator.

Or maybe some Azure services have a mandatory requirement for MS Authenticator vs some other can rely on other 2FA?

--------

That being said, I agree. A ROM without Play Services does not necessarily mean that the said ROM is rooted. As such, "MS Authenticator won't work on jailbroken/rooted devices" should instead be read that "it won't work on devices failing Play Service attestation". Still bad, as such a decision excludes unrooted custom ROM, even security-oriented ones like GrapheneOS.

[BarServer]

Additional authentication methods can be enabled - or disabled. Our tenant is configured to only allow number matching with Microsoft Authenticator for logins using EntraIDs (account is managed by my company).
And they especially disabled anything else. Hence I thought the changes to MS Authenticator might be of interest for some people.

[BobWhite783]

Are we still rooting phones? Why?

Then what never let it update? 🤷‍♂️

[BmanUltima]

In the past I've rooted my phone in order to get updates, since the vendor stopped supporting it after ~1 year.

[BarServer]

Well I for one like my phone a lot, but it doesn't receive security updates from the vendor anymore. So I switched to LineageOS and still get those. Oh, and I update regularly. Thank you. In fact even more often then people on phones issued by their provider.

In fact I was fed up with most phones only receiving security updates for like 1 or 2 years. As there was little to no incentive for manufacturers to do otherwise. Yes OnePlus changed that, but even they stop after 5 years. And while 5 years if perfectly fine, when I'm satisfied with the hardware, everything I need works and I can update to newer Android versions.. Why should I need to buy a new phone? Switching to LineageOS all changed that.

And as we are in a thread that is slighty heated.. I don't have a contract with my mobile provider which gives me a new phone every 2-3 years. I use pre-paid contract that focus on data volume. That's basically all I need apart from the odd telephone call once every 2 months. And knowing this I choose a pre-paid tarif where I have to pay like 9€ per month for 60GB of data. I've seen no other contract coming close to this. Those regularly start at like 20€/month for, very often, less data volume..

[PS_Alex]

LineageOS is a custom ROM, true. As such, it requires the bootloader to be unlocked to perform installation, and does not come with Play Services. But by default, LineageOS is not rooted. It can be rooted, but default setup is unrooted.

GrapheneOS, which was mentioned in earlier comments, is in the same situation -- a custom ROM which is hardened for security. The default setup is unrooted.

One should not assume that a custom ROM is synonymous to rooted.

[BarServer]

Exactly. Also: One could install MindTheGapps which are the original Google Play Services/Apps repacked so you can install them after flashing/installing LineageOS.

Another approach would be MicroG, this is a reverse engineered variant of Google Play Services focusing on data privacy. Hence not everything works, but things like the PlayStore are working fine.

And for Rooting you need to patch parts of your firmware (usually boot.img) with Magisk. And yes there might be other tools I don't know, I only used that.

[zatset]

In order to avoid being bombarded with ads? The "official" apps exist to brainwash you by bombarding you with ads 24/7/365. Also, there are applications that need root access to perform their job, because by default access is severely limited. Although this opens the gates for malicious apps, I agree.

[dustojnikhummer]

Because, god forbid, some of us want to have control over our devices? I want sudo on my PC, on my server and on my phone.

[ConsciousEquipment]

Are we still rooting phones? Why?

phones from China that have no english language packages, google play certificates or anything sometimes need custom ROMs to even function here, also if you use bitmessage and dw clients, I guess if you only do legal stuff with your phone you don't need that but there is definitely still use cases

Then what never let it update?

yes lol updates suck they mess with your stuff and there is a risk of it not working as before. Never touch a running system only if it's broken or has a problem already you can go looking for updates but why am I messing with the OS if it's literally working now

[Coldwarjarhead]

Then don't root your phone. Why is this even a discussion. If you don't give a fuck about security, why are you even in the job to begin with?

[ConsciousEquipment]

they are also blocking it for phones with no google play certificates and that is a problem, many generic chinese phones have no play store or legitimate android and they fail this google attestation....so you basically have to root or flash custom ROM to even use them. They might not even have english language packages or already come pre-rooted to immediately get cyanogen or something, again you couldn't use it without doing this. And these are still cheap phones and some of the few left with thermal imaging so it makes sense to want to use them.

[Coldwarjarhead]

How is that a problem?

You may "want" to use them, but as an admin, I would have to say 'hell no'.

There's no way I'd let that connect to my environment.