No changes in configurations are required in Microsoft Authenticator or the Azure portal to enable FIPS 140 compliance. Beginning with Microsoft Authenticator for iOS version 6.6.8, Azure AD authentications will be FIPS 140 compliant by default.Īuthenticator leverages the native Apple cryptography to achieve FIPS 140, Security Level 1 compliance on Apple iOS devices beginning with Microsoft Authenticator version 6.6.8. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP). This helps federal agencies meet the requirements of Executive Order (EO) 14028 and healthcare organizations working with Electronic Prescriptions for Controlled Substances (EPCS).įIPS 140 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. FIPS 140 compliant for Azure AD authenticationīeginning with version 6.6.8, Microsoft Authenticator for iOS is compliant with Federal Information Processing Standard (FIPS) 140 for all Azure AD authentications using push multi-factor authentications (MFA), passwordless Phone Sign-In (PSI), and time-based one-time passcodes (TOTP).Ĭonsistent with the guidelines outlined in NIST SP 800-63B, authenticators are required to use FIPS 140 validated cryptography. When two methods are required, users can reset using either a notification or verification code in addition to any other enabled methods. To ensure the highest level of security for self-service password reset when only one method is required for reset, a verification code is the only option available to users. Users view the notification, and if it's legitimate, select Verify. The Authenticator app can help prevent unauthorized access to accounts and stop fraudulent transactions by pushing a notification to your smartphone or tablet. To get started with passwordless sign-in, see Enable passwordless sign-in with the Microsoft Authenticator. This authentication method provides a high level of security, and removes the need for the user to provide a password at sign-in.

When the correct number is selected, the sign-in process is complete. Instead of seeing a prompt for a password after entering a username, a user that has enabled phone sign-in from the Authenticator app sees a message to enter a number in their app. Instead, users can register their mobile app at or as part of the combined security info registration at. Users don't have the option to register their mobile app when they enable SSPR.

Ms authenticator app