How to Set Up Microsoft Authenticator for Your Business

Microsoft Authenticator is a free mobile app that adds multi-factor authentication (MFA) to your Microsoft 365 account — Mycelium 365 recommends it as the default MFA method for all Australian business users because it is more secure than SMS codes and works offline. This guide walks through the complete setup process for business accounts.

What is Microsoft Authenticator and why does your business need it?

Multi-factor authentication (MFA) requires users to prove their identity with something they know (a password) and something they have (a device), dramatically reducing the risk of account takeover from phishing or credential theft. SMS-based MFA is weaker because text messages can be intercepted through SIM-swap attacks, SS7 exploits, or number porting fraud — all of which are increasingly common against Australian businesses. Microsoft Authenticator solves this by generating time-based one-time passwords (TOTP) directly on the device and by delivering push notifications through an encrypted channel that cannot be intercepted over the mobile network. MFA is also Mitigation Strategy #7 in the Australian Signals Directorate's Essential Eight, and the ACSC specifically recommends authenticator apps over SMS. For Microsoft 365 business accounts in Australia, Microsoft Authenticator is the default recommendation from both Microsoft and Mycelium 365 because it is free, deeply integrated with Entra ID, and supports phishing-resistant number matching.

How to set up Microsoft Authenticator — step by step

1. Download Microsoft Authenticator from the App Store or Google Play. On iPhone open the App Store and search "Microsoft Authenticator"; on Android open the Google Play Store and do the same. Confirm the publisher is "Microsoft Corporation" before installing to avoid look-alike apps.

2. Sign into Microsoft 365 at aka.ms/MFASetup. On a desktop or laptop browser, go to https://aka.ms/MFASetup and sign in with your business Microsoft 365 email address and password. You will be taken to the additional security verification page.

3. Choose "Mobile app" as the authentication method. From the dropdown, select "Mobile app" instead of "Authentication phone" or "Office phone". This tells Microsoft 365 you want to authenticate through the Authenticator app rather than SMS or a voice call.

4. Select "Receive notifications for verification". Underneath the mobile app option, choose "Receive notifications for verification" — this enables the push-notification approval flow, which is faster and more secure than typing a six-digit code every login. Click "Set up" to continue.

5. Scan the QR code displayed on screen. Open Microsoft Authenticator on your phone, tap the "+" icon in the top right, choose "Work or school account", then "Scan a QR code". Point your camera at the QR code shown in your browser to link the account.

6. Approve the test notification. Once the QR code is scanned, Microsoft 365 will send a test push notification to your phone. Tap "Approve" in Authenticator, and if prompted, enter the two-digit number shown on your screen (number matching) to complete verification.

7. Set up a backup authentication method (phone number). Add a mobile phone number as a backup so you can still receive an SMS or voice call if you lose access to Authenticator. Save your changes — MFA is now active on your account.

How to set up Microsoft Authenticator on a new phone

When you upgrade or replace your phone, you need to move your Microsoft Authenticator accounts across before wiping the old device. The easiest path is the built-in cloud backup and restore: on your old phone, open Authenticator → Settings → Backup and turn on iCloud Backup (iOS) or Cloud Backup (Android) using a personal Microsoft account. On the new phone, install Authenticator, sign into the same personal Microsoft account, and tap "Begin recovery". Your work or school account will restore automatically, but you may still be asked to verify it once from an already-signed-in session. If you did not enable backup, you will need to re-register your account from scratch — sign into aka.ms/MFASetup from a browser where you are still authenticated, delete the old Authenticator entry, and repeat the setup steps above. If you lose all access, contact your IT administrator or Mycelium 365 helpdesk to reset your MFA registration.

How to set up Microsoft Authenticator for multiple accounts

Microsoft Authenticator supports unlimited accounts, so most Australian business users end up with several linked to the same app. To add another Microsoft 365 account, tap the "+" icon, choose "Work or school account", and scan the QR code from that tenant's MFA setup page — each account appears as a separate tile in the app. Personal Microsoft accounts (Outlook.com, Xbox, personal OneDrive) use the "Personal account" option and sign-in flow instead of a QR code. You can also add non-Microsoft accounts such as Google Workspace, AWS, GitHub, or any TOTP-based service by choosing "Other account (Google, Facebook, etc.)" and scanning that service's QR code. Long-press any account tile to rename, reorder, or remove it, which is helpful when you manage two or three tenants for different clients or subsidiaries.

Troubleshooting Microsoft Authenticator — common issues

• Time sync errors ("verification code is incorrect"). The TOTP codes are based on the device clock, so if your phone time drifts even 30 seconds the codes will fail. Open Authenticator → Settings → Time correction for codes → Sync now, and make sure automatic date/time is enabled in your phone's system settings.

• Push notifications not arriving. Notifications can be blocked by battery-saver mode, Do Not Disturb, or a poor data connection. Open your phone's Settings → Notifications → Authenticator and confirm alerts, sounds, and badges are all enabled; then toggle Wi-Fi off and on to refresh the connection.

• App not generating codes. If the six-digit code screen is blank or frozen, force-close and reopen the app; if that fails, restart the phone. This usually resolves cached state issues without any account impact.

• Lost phone recovery. If you still have another signed-in session (for example on your work laptop), go to https://mysignins.microsoft.com/security-info and delete the old device, then register your new phone. If you have no active session, your IT administrator must reset MFA on your account.

• "I can't get into my account". Use the "Sign-in options" link on the Microsoft 365 login screen to try your backup phone number or a temporary access pass issued by your admin. If none of these work, contact your IT team or the Mycelium 365 helpdesk — do not attempt to create a new account.

How does Microsoft Authenticator help Australian businesses meet Essential Eight requirements?

The Essential Eight is the Australian Signals Directorate's baseline cyber security framework, and Multi-Factor Authentication is Mitigation Strategy #7. The ACSC explicitly recommends authenticator apps over SMS because SMS is vulnerable to interception, SIM-swap attacks, and telecommunications provider compromise. Maturity Level 1 (ML1) requires MFA for internet-facing services and privileged accounts; Microsoft Authenticator satisfies this out of the box. Maturity Level 2 (ML2) extends MFA to all users accessing important data repositories, which typically means enforcing MFA across every Microsoft 365 sign-in through Entra ID Conditional Access. Maturity Level 3 (ML3) requires phishing-resistant MFA — for Microsoft Authenticator this means enabling number matching and, where possible, moving to passkeys or FIDO2 hardware keys for administrators. Mycelium 365 recommends Authenticator with number matching as the baseline for all Australian businesses, with FIDO2 keys layered on for Global Administrators and finance staff.

How Mycelium 365 helps businesses deploy Microsoft Authenticator at scale

Rolling out MFA to a 20–300 user business is straightforward when it is planned properly, and messy when it is not. Mycelium 365 deploys Microsoft Authenticator through Microsoft Intune and enforces it with Entra ID Conditional Access policies, so every user is required to register within a defined grace window and no account is left uncovered. For larger cutovers we run bulk enrolment sessions and provide printed step-by-step guides tailored to your tenant. If you prefer a lighter touch, we can enable self-service MFA registration and back it up with our helpdesk to handle exceptions, lost phones, and new starters.

If your business is still relying on SMS codes, or if MFA coverage is patchy across your Microsoft 365 tenant, that is exactly the kind of gap an IT technology roadmap is designed to close. Get in touch with Mycelium 365 and we will scope an Authenticator rollout that fits your team size, risk profile, and Essential Eight maturity target — most SMB deployments are complete within two weeks and reduce account-takeover risk from day one.