How to make use of MS Authenticator for all my logins

alan Sears 20 Reputation points
2026-05-11T15:55:22.5866667+00:00

I have about 50 sites that require some form of secure login: Username/email + password, memorable word, 2FA, FaceID or whatever. I don't like email addresses as IDs because they are not necessarily permanent. I had one hacked and it became unusable but one or two sites insist on sending recovery data to it which means I can't get in to correct it!

I also find that passwords - and I go for long, unmemorable ones - may get saved by this password manager or that one, or perhaps none, so I have to keep a manual list of all these complex passwords. Not a good way to go.

I would like a secure login that relies on a single password manager or just uses the authenticator on my phone. Apart from Microsoft itself I have only one site out of fifty that uses MS Authenticator and iCloud Passwords manager: it asks for my email address (I would prefer Username, however), auto fills the password box, then tells me to enter the Authenticator code from my phone. Easy for me and so far it's not failed.

I assume the site managers determine which protocol they will use, and that we are never going to get close to a unified approach. Apart from this issue I am comfortable with IT technology, while I feel sorry for the millions(?) out there who trip over forgotten passwords, mysterious passkeys and the rest of this unfathomable nightmare. But maybe I'm the one who has lost sight of how it actually all works brilliantly.

Microsoft Security | Microsoft Authenticator
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-05-11T15:55:53.0933333+00:00

    Microsoft Authenticator and password managers solve different parts of the problem and can be combined, but they cannot fully replace each other across all sites because each website chooses its own sign-in and MFA methods.

    Key points from the current ecosystem:

    1. Role of Microsoft Authenticator
    • Authenticator can be used in three main ways:
      1. As an extra way to verify sign-in (MFA/2-step verification) on top of a password.
      2. As the primary way to sign in every time using one-time codes (classic 2FA).
      3. As the only way to sign in (passwordless), where sign-in is approved on the phone instead of typing a password.
    • It works with:
      • Microsoft personal accounts.
      • Work/school accounts (Microsoft Entra ID / Microsoft 365).
      • Many non-Microsoft accounts (e.g., Amazon, Facebook, Google) as a TOTP (time-based one-time password) authenticator.
    • For Microsoft accounts, Authenticator can also be used to go fully passwordless, so sign-in is done via app approval, Windows Hello, security keys, or SMS instead of a password.
    1. Why Authenticator cannot be used for all logins
    • Each site decides:
      • Whether to support MFA at all.
      • Which MFA methods to support (email codes, SMS, TOTP apps like Authenticator, WebAuthn/passkeys, etc.).
      • Whether to allow username-only IDs or require email addresses.
    • Because of this, it is not possible to force all 50 sites to use Microsoft Authenticator or a single unified protocol.
    • The realistic best case is:
      • Use Authenticator wherever a site supports TOTP or explicitly supports Microsoft Authenticator.
      • Use a single password manager for everything else.
    1. Using Microsoft Authenticator as widely as possible
    • For Microsoft personal and work/school accounts:
      • Add Authenticator as a sign-in method.
      • Optionally enable two-step verification or go passwordless so that passwords are no longer needed for those accounts.
    • For other sites that support authenticator apps:
      • When a site offers “use an authenticator app” or “scan QR code” for 2FA, register it in Microsoft Authenticator.
      • Authenticator will then generate one-time codes for those sites.
    • This gives a single MFA app for as many services as possible, even if the primary sign-in is still username/password.
    1. Managing passwords alongside Authenticator
    • A password manager remains necessary because:
      • Many sites still require passwords and do not support passwordless or TOTP.
      • Authenticator is designed for MFA and passwordless flows, not for storing arbitrary passwords.
    • Microsoft Edge’s built-in password manager is designed to:
      • Encourage strong, unique passwords per site.
      • Autofill only on the correct site, reducing phishing risk.
      • Sync passwords across devices when signed in.
    • The main trade-off:
      • If a device session is compromised, an attacker could retrieve saved passwords.
      • Without a password manager, attackers might instead try to capture keystrokes or submitted passwords.
    • For most threat models, using a password manager like Edge’s is recommended, especially when combined with MFA (Authenticator, SMS, or WebAuthn/passkeys).
    1. Moving toward fewer passwords and more secure sign-in
    • For Microsoft accounts:
      • Use Microsoft Authenticator to sign in without a password.
      • Optionally remove the password and rely on passwordless methods (Authenticator, Windows Hello, security keys, or SMS).
    • For other services that support it:
      • Enable 2FA with Authenticator or WebAuthn/passkeys.
    • This reduces the number of passwords that must be remembered or stored, while still using a password manager for legacy or non-MFA sites.

    In practice, the most unified approach currently available is:

    • One primary password manager (for all passwords, including long, unique ones).
    • One primary authenticator app (Microsoft Authenticator) for MFA and passwordless sign-in wherever supported.
    • Gradually enabling passwordless and MFA options on each site as they become available, accepting that some will remain password-based.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.