Microsoft Authenticator data API: MFA, passkeys and passwordless sessions

Microsoft Corporation · Identity

Microsoft Authenticator is Microsoft's mobile sign-in companion for work, school and personal accounts. It turns the phone into a phishing-resistant credential — push approvals with number matching, TOTP codes, passkeys and passwordless phone sign-in — making it the default second factor for organizations that run on Microsoft Entra ID.

As a data source, the app exposes the identity objects behind those approvals: device registrations returning OathSecret and PhoneAppDetailId, pending challenges carrying firstEntropyNumber match digits and richContextDetails sign-in context, per-user policy flags such as numberMatchingRequiredState, and passwordless sessions with their fidoChallenge values. Security teams build device-inventory, policy-audit and session-monitoring integrations on top of these fields.

Microsoft Authenticator is Microsoft's sign-in companion for work, school and personal Microsoft accounts: push approvals with number matching, TOTP codes, passkeys and passwordless phone sign-in, and one of the most widely deployed workforce MFA apps. Behind those approvals sits a rich identity dataset — device registrations carrying oath secrets and tenant routing hints, pending sign-in challenges with match digits and context, per-user authenticator policy flags, and passkey credentials. Security teams use it to inventory enrolled handsets, audit number-match policy, monitor passwordless sessions and automate the passkey lifecycle.

Screenshots

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

Issue an OAuth 2.0 access token
POST /v1/oauth/token osint
Exchanges an authorization code or refresh_token for the Bearer access_token later attached to policy, passkey, session and device-registration calls.
Auth: Public-client token request. Body carries grant_type (authorization_code, refresh_token or srv_challenge), client_id and scope. The returned access_token is sent as Authorization: Bearer on the policy, passkey and session calls.
- grant_type
- client_id
- code
- redirect_uri
- scope
- token_type
- expires_in
- ext_expires_in
- access_token
- refresh_token
- id_token
```
POST /v1/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&client_id=11112222-3333-4444-5555-666677778888&code=0.AXEA...&redirect_uri=msauth://com.example.mfaapp/callback&scope=https://directory.example.net/.default offline_access
```
```
{
  "token_type": "Bearer",
  "scope": "https://directory.example.net/.default",
  "expires_in": 3599,
  "ext_expires_in": 3599,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example",
  "refresh_token": "0.AXEA.example",
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example"
}
```
- reconstructed from the app's sign-in and token exchange flow
- matches the Bearer credential attached to the policy, passkey and session calls

Register Authenticator as MFA method

POST /v1/mfa/devices/register osint

Enrolls this Android handset as a Microsoft Authenticator MFA method and returns the account name, TOTP oath secret, phoneAppDetailId and tenant routing hints used by later calls.

Auth: Authorization: Bearer access token for the work or school account. Also sends app and device headers (app name and version, device platform and an action header) plus a hash of the push registration token.

AccountName
GroupKey
OathSecret
PhoneAppDetailId
MfaServerInUse
IsDeviceTokenValidationSuccessful
IsOathTokenEnabled
ReplicationScope
RoutingHint
TenantCountryCode
CurrentDefaultMethod
UserCredentialPolicyProto
DeviceName
DeviceToken
NotificationType
AppPackageName

POST /v1/mfa/devices/register HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
Content-Type: application/xml
X-App-Name: Authenticator
X-App-Version: 6.2609.6214
X-Device-Platform: Android

<RegisterDeviceRequest>
  <Version>1.0</Version>
  <AppPackageName>com.example.mfaapp</AppPackageName>
  <AuthenticatorFlavor>Authenticator</AuthenticatorFlavor>
  <DeviceName>Pixel 8</DeviceName>
  <DeviceTag>Android</DeviceTag>
  <DeviceToken>fcm-registration-token</DeviceToken>
  <NotificationType>FCM</NotificationType>
  <PhoneAppVersion>6.2609.6214</PhoneAppVersion>
  <RequestId>9c2e1a44-7b11-4d90-9e3a-2f0c8b1d4e55</RequestId>
  <UpdateDefaultMethod>true</UpdateDefaultMethod>
  <Uses>Notification Oath</Uses>
</RegisterDeviceRequest>

{
  "AccountName": "[email protected]",
  "GroupKey": "g-7f2c91aa",
  "OathSecret": "JBSWY3DPEHPK3PXP",
  "PhoneAppDetailId": "pad-8e21c0",
  "MfaServerInUse": false,
  "IsDeviceTokenValidationSuccessful": true,
  "IsOathTokenEnabled": true,
  "ReplicationScope": "NAM",
  "RoutingHint": "contoso.example",
  "TenantCountryCode": "US",
  "CurrentDefaultMethod": "PhoneAppNotification",
  "UserCredentialPolicyProto": "CgNhcHA="
}

reconstructed from the app's work-account enrollment flow
matches the oath secret and tenant routing hints returned when a device is added

Discover MFA service endpoints

POST /v1/mfa/endpoints/resolve opendata

Returns the regional MFA relay URLs and replicationScopes the phone app should use for subsequent MFA poll and approve calls.

Auth: Device-bound MFA headers: XML content type, app name and version, device platform, a device-token header and an action header selecting the endpoint-discovery request.

version
defaultUrl
url
endpoints
replicationScopes

POST /v1/mfa/endpoints/resolve HTTP/1.1
Content-Type: application/xml
X-MFA-Action: getEndpoints
X-App-Name: Authenticator
X-Device-Platform: Android

<mfaMessage version="1.6">
  <request request-id="b41c0e22-11aa-4c01-9f10-88c0aa11bb22" async="0" language="en">
    <getEndpointsRequest/>
  </request>
</mfaMessage>

{
  "version": "1.6",
  "defaultUrl": "https://mfa.example.net/v1/mfa/relay",
  "url": "https://mfa.example.net/v1/mfa/relay",
  "endpoints": {
    "NAM": "https://mfa-nam.example.net/v1/mfa/relay",
    "EUR": "https://mfa-eur.example.net/v1/mfa/relay"
  },
  "replicationScopes": "NAM,EUR"
}

reconstructed from the app's regional endpoint discovery step
matches the replication scopes the phone uses for later poll and approve calls

Poll pending MFA notifications

POST /v1/mfa/challenges/poll osint

Asks the MFA service whether a sign-in is waiting for this device and returns the username, groupKey, oathCounter and phoneAppDetailId for the pending challenge.

Auth: Device-bound MFA headers plus optional tenant routing headers (tenant id, replication scope, routing hint and tenant country) from the registered account. An action header selects the pending-challenge check.

result
groupKey
username
oathCounter
padUrl
phoneAppDetailId
dosPreventer
deviceToken
previousDeviceToken
AuthenticatorFlavor

POST /v1/mfa/challenges/poll HTTP/1.1
Content-Type: application/xml
X-MFA-Action: checkPendingChallenge
X-MFA-Interactive: true
X-Tenant-Id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-Routing-Hint: contoso.example

<checkPendingChallengeRequest>
  <dosPreventer>dp-9f31</dosPreventer>
  <deviceToken notificationType="fcm">fcm-registration-token</deviceToken>
  <previousDeviceToken>fcm-registration-token-old</previousDeviceToken>
  <version>6.2609.6214</version>
  <osVersion>14</osVersion>
  <AuthenticatorFlavor>Authenticator</AuthenticatorFlavor>
</checkPendingChallengeRequest>

{
  "result": "NotificationWaiting",
  "groupKey": "g-7f2c91aa",
  "username": "[email protected]",
  "oathCounter": 48211,
  "padUrl": "https://mfa.example.net/v1/mfa/relay",
  "phoneAppDetailId": "pad-8e21c0"
}

reconstructed from the app's pending sign-in check
matches the approve notification that appears when a challenge is waiting

Fetch MFA challenge context

POST /v1/mfa/challenges/context osint

Loads the pending MFA challenge shown on the approve screen: number-matching entropy digits, sign-in context, user objectId, tenant, fraud flags and whether app lock is required.

Auth: Device-bound MFA headers; an action header selects the challenge-context request. Tenant routing headers from the registered account are included when present.

responseGuid
mode
fraudBlock
fraudAllowed
groupKey
phoneAppDetailId
username
tenantId
objectId
accountName
firstEntropyNumber
secondEntropyNumber
thirdEntropyNumber
sasSessionId
richContextDetails
returnLocationData
isAppLockRequired
pinChangeRequired
oathTokenEnabled
oathCounter
replicationScope
routingHint
tenantCountryCode
userCredentialPolicyProto

POST /v1/mfa/challenges/context HTTP/1.1
Content-Type: application/xml
X-MFA-Action: getChallengeContext
X-Tenant-Id: 72f988bf-86f1-41af-91ab-2d7cd011db47

<challengeContextRequest>
  <challengeContext>
    <guid>3fa85f64-5717-4562-b3fc-2c963f66afa6</guid>
    <oathCode>483921</oathCode>
    <needDosPreventer>yes</needDosPreventer>
    <deviceToken>fcm-registration-token</deviceToken>
    <version>6.2609.6214</version>
    <osVersion>14</osVersion>
  </challengeContext>
</challengeContextRequest>

{
  "responseGuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "mode": "Push",
  "fraudBlock": false,
  "fraudAllowed": true,
  "groupKey": "g-7f2c91aa",
  "phoneAppDetailId": "pad-8e21c0",
  "username": "[email protected]",
  "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
  "objectId": "84b12a9c-0e33-4d1a-9f44-11aa22bb33cc",
  "accountName": "[email protected]",
  "firstEntropyNumber": "14",
  "secondEntropyNumber": "67",
  "thirdEntropyNumber": "32",
  "sasSessionId": "sas-9c01",
  "richContextDetails": "Sign-in from Chrome on Windows",
  "returnLocationData": true,
  "isAppLockRequired": true,
  "oathTokenEnabled": true,
  "oathCounter": 48212,
  "replicationScope": "NAM",
  "routingHint": "contoso.example",
  "tenantCountryCode": "US",
  "userCredentialPolicyProto": "CgNhcHA="
}

reconstructed from the app's number-match approve screen
matches the match digits and sign-in context shown to the user

Submit MFA approve or deny

POST /v1/mfa/challenges/result osint

Posts the user's approve or deny decision for a pending MFA challenge, including whether app lock was used and the current OATH counter.

Auth: Device-bound MFA headers; an action header selects the challenge-result submission. May include locationData when the challenge asked for it.

guid
authenticationResult
oldDeviceToken
newDeviceToken
oathTokenCounter
isAppLockUsed
completedInteractively
locationData
result

POST /v1/mfa/challenges/result HTTP/1.1
Content-Type: application/xml
X-MFA-Action: submitChallengeResult

<challengeResultRequest>
  <challengeContext>
    <guid>3fa85f64-5717-4562-b3fc-2c963f66afa6</guid>
    <needDosPreventer>no</needDosPreventer>
    <deviceToken>fcm-registration-token</deviceToken>
    <version>6.2609.6214</version>
    <osVersion>14</osVersion>
  </challengeContext>
  <authenticationResult>0</authenticationResult>
  <oathTokenCounter>48212</oathTokenCounter>
  <isAppLockUsed>true</isAppLockUsed>
  <completedInteractively>true</completedInteractively>
</challengeResultRequest>

{
  "result": "Success",
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
}

reconstructed from the app's approve and deny actions
matches the decision posted after the user responds to a challenge

Validate MFA PIN on approve

POST /v1/mfa/challenges/pin osint

Submits the user's app PIN (and optional number-match digit) when the MFA challenge requires PIN validation before approve.

Auth: Device-bound MFA headers; an action header selects PIN validation. Body carries pin (optionally stored=yes), selectedEntropyNumber and isAppLockUsed.

guid
pin
stored
authenticate
oathCounter
completedInteractively
selectedEntropyNumber
isAppLockUsed
pinRetries
pinChangeRequired
result

POST /v1/mfa/challenges/pin HTTP/1.1
Content-Type: application/xml
X-MFA-Action: validatePin

<pinValidationRequest>
  <challengeContext>
    <guid>3fa85f64-5717-4562-b3fc-2c963f66afa6</guid>
    <needDosPreventer>no</needDosPreventer>
    <deviceToken>fcm-registration-token</deviceToken>
    <version>6.2609.6214</version>
    <osVersion>14</osVersion>
  </challengeContext>
  <pin stored="no">4821</pin>
  <authenticate>yes</authenticate>
  <oathCounter>48212</oathCounter>
  <completedInteractively>yes</completedInteractively>
  <selectedEntropyNumber>14</selectedEntropyNumber>
  <isAppLockUsed>yes</isAppLockUsed>
</pinValidationRequest>

{
  "result": "Success",
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "pinRetries": 3,
  "pinChangeRequired": false
}

reconstructed from the app's PIN-on-approve step
matches the retry counter returned after a wrong PIN

Rotate push device token
POST /v1/devices/push-token opendata
Tells the notification service to replace the previous push registration token so push MFA keeps working after the mobile platform refreshes it.
Auth: Device-bound MFA headers; an action header selects the token-change request and the call is marked non-interactive.
- dosPreventer
- oldDeviceToken
- newDeviceToken
- notificationType
- replicationScopes
- version
- osVersion
- result
```
POST /v1/devices/push-token HTTP/1.1
Content-Type: application/xml
X-MFA-Action: changeDeviceToken
X-MFA-Interactive: false

<deviceTokenChangeRequest>
  <dosPreventer>dp-9f31</dosPreventer>
  <oldDeviceToken>fcm-registration-token-old</oldDeviceToken>
  <newDeviceToken notificationType="fcm">fcm-registration-token-new</newDeviceToken>
  <version>6.2609.6214</version>
  <osVersion>14</osVersion>
  <replicationScopes>NAM</replicationScopes>
</deviceTokenChangeRequest>
```
```
{
  "result": "Success",
  "newDeviceToken": "fcm-registration-token-new"
}
```
- reconstructed from the app's push registration refresh handling
- matches the re-registration that follows a platform token rotation

Read authenticator methods policy

GET /v1/accounts/{id}/mfa-policy opendata

Reads the user's Microsoft Authenticator policy, including number matching, location display, software TOTP and companion-app flags that drive the in-app MFA experience.

Auth: Authorization: Bearer directory access token obtained for the signed-in work account.

authenticationMethod
isEnabled
isRequired
settings
authenticationMode
companionAppAllowedState
numberMatchingRequiredState
displayAppInformationRequiredState
displayLocationInformationRequiredState
isSoftwareTotpEnabled
isAttestationEnforced
isEnforceApprovalPinEnabled
isSelfServiceRegistrationAllowed
passkeyProfiles

GET /v1/accounts/84b12a9c-0e33-4d1a-9f44-11aa22bb33cc/mfa-policy HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example

{
  "value": [
    {
      "authenticationMethod": "microsoftAuthenticator",
      "isEnabled": true,
      "isRequired": true,
      "settings": {
        "authenticationMode": "any",
        "companionAppAllowedState": "enabled",
        "numberMatchingRequiredState": "enabled",
        "displayAppInformationRequiredState": "enabled",
        "displayLocationInformationRequiredState": "enabled",
        "isSoftwareTotpEnabled": true,
        "isAttestationEnforced": false,
        "isEnforceApprovalPinEnabled": false,
        "isSelfServiceRegistrationAllowed": true,
        "passkeyProfiles": []
      }
    }
  ]
}

reconstructed from the app's policy-driven MFA behavior
matches the number-matching and location flags behind the approve screen

Read security defaults tenant policy
GET /v1/tenants/security-defaults opendata
Reads whether the tenant has identity security defaults enabled, which changes how the app presents MFA registration and approval flows.
Auth: Authorization: Bearer directory access token.
- id
- displayName
- description
- isEnabled
```
GET /v1/tenants/security-defaults HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
```
```
{
  "id": "00000000-0000-0000-0000-000000000005",
  "displayName": "Security Defaults",
  "description": "Security defaults provides preconfigured security settings.",
  "isEnabled": true
}
```
- reconstructed from the app's tenant policy check
- matches the registration flow shown when security defaults are enabled

Get FIDO2 passkey creation options

GET /v1/accounts/{id}/passkeys/creation-options osint

Fetches WebAuthn credential-creation options so the app can mint a platform passkey for the signed-in Entra user.

Auth: Authorization: Bearer directory access token.

publicKey
rp
user
challenge
pubKeyCredParams
timeout
authenticatorSelection
authenticatorAttachment
userVerification
requireResidentKey
attestation
hmacCreateSecret
credentialProtectionPolicy

GET /v1/accounts/84b12a9c-0e33-4d1a-9f44-11aa22bb33cc/passkeys/creation-options?challengeTimeoutInMinutes=5 HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example

{
  "publicKey": {
    "rp": {"id": "passkeys.example.net", "name": "Example IDP"},
    "user": {"id": "84b12a9c-0e33-4d1a-9f44-11aa22bb33cc", "name": "[email protected]", "displayName": "Alex Contoso"},
    "challenge": "dGhpc2lzYWNoYWxsZW5nZQ",
    "pubKeyCredParams": [{"type": "public-key", "alg": -7}],
    "timeout": 300000,
    "authenticatorSelection": {"authenticatorAttachment": "platform", "userVerification": "required", "requireResidentKey": true},
    "attestation": "direct",
    "extensions": {"hmacCreateSecret": true, "credentialProtectionPolicy": "userVerificationRequired"}
  }
}

reconstructed from the app's passkey setup flow
matches the WebAuthn options handed to the platform authenticator

Register FIDO2 passkey

POST /v1/accounts/{id}/passkeys osint

Uploads the platform authenticator attestation so Entra ID stores a new FIDO2 method on the user.

Auth: Authorization: Bearer directory access token.

displayName
publicKeyCredential
id
rawId
type
attestationObject
clientDataJSON
createdDateTime
aaGuid
model
attestationLevel
passkeyType
attestationCertificates

POST /v1/accounts/84b12a9c-0e33-4d1a-9f44-11aa22bb33cc/passkeys HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
Content-Type: application/json

{
  "displayName": "Pixel 8",
  "publicKeyCredential": {
    "id": "cred-aa11",
    "rawId": "Y3JlZC1hYTEx",
    "type": "public-key",
    "response": {
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10",
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0"
    }
  }
}

{
  "id": "fido-method-01",
  "displayName": "Pixel 8",
  "createdDateTime": "2026-09-29T12:04:11Z",
  "aaGuid": "ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4",
  "model": "Pixel 8",
  "attestationLevel": "attested",
  "passkeyType": "deviceBound",
  "attestationCertificates": []
}

reconstructed from the app's passkey enrollment step
matches the attestation object produced by the device key store

Delete Authenticator MFA method
DELETE /v1/accounts/{id}/mfa-methods/{methodId} osint
Removes a registered Microsoft Authenticator method from the user when the account is deleted or the device is unregistered in-app.
Auth: Authorization: Bearer directory access token.
- id
- methodId
- status
```
DELETE /v1/accounts/84b12a9c-0e33-4d1a-9f44-11aa22bb33cc/mfa-methods/pad-8e21c0 HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
```
```
{
  "status": 204
}
```
- reconstructed from the app's account removal flow
- matches the method cleanup that follows device unregistration
Delete FIDO2 passkey method
DELETE /v1/accounts/{id}/passkeys/{methodId} osint
Removes a registered FIDO2 / passkey method from the user when the passkey is deleted in the app.
Auth: Authorization: Bearer directory access token.
- id
- methodId
- status
```
DELETE /v1/accounts/84b12a9c-0e33-4d1a-9f44-11aa22bb33cc/passkeys/fido-method-01 HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
```
```
{
  "status": 204
}
```
- reconstructed from the app's passkey management screen
- matches the deletion issued when a passkey is removed
Read organization data boundary
GET /v1/tenants/current opendata
Reads the signed-in tenant's organization record so the app can honor the regional data boundary (dataBoundary) when uploading diagnostic logs.
Auth: Authorization: Bearer directory access token obtained for the signed-in work account.
- id
- displayName
- countryLetterCode
- dataBoundary
```
GET /v1/tenants/current HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
```
```
{
  "value": [
    {
      "id": "72f988bf-86f1-41af-91ab-2d7cd011db47",
      "displayName": "Contoso",
      "countryLetterCode": "US",
      "dataBoundary": "Global"
    }
  ]
}
```
- reconstructed from the app's diagnostic upload settings
- matches the data-boundary value that routes logs regionally

List passwordless sign-in sessions

GET /v1/signin/sessions osint

Lists pending passwordless phone sign-in sessions for the account, including number-match digits, the FIDO challenge and the requesting client details.

Auth: Authorization: Bearer access token. Also sends client correlation headers: a request id plus client SKU and client name.

sessionsList
username
userObjectIdHash
code
sessionId
sessionType
requestTime
expirationTime
audience
entropy1
entropy2
entropy3
authDetails
tenantId
userCredentialPolicy
phoneAppDetails
fidoChallenge

GET /v1/signin/sessions HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
client-request-id: 5e2a1c90-44bb-4d11-a0e1-77aa11bb22cc
X-Client-SKU: authenticator.android
X-Client-Name: AuthenticatorAndroid

{
  "sessionsList": [
    {
      "session": {
        "username": "[email protected]",
        "userObjectIdHash": "a11c0e22",
        "code": "14",
        "sessionId": "sess-01",
        "sessionType": "Passwordless",
        "requestTime": 1759142400,
        "expirationTime": 1759142700,
        "audience": "https://idp.example.net",
        "entropy1": 14,
        "entropy2": 67,
        "entropy3": 32,
        "authDetails": "Chrome on Windows",
        "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
        "userCredentialPolicy": "CgNhcHA=",
        "phoneAppDetails": "pad-8e21c0",
        "fidoChallenge": "dGhpc2lzYWNoYWxsZW5nZQ"
      }
    }
  ]
}

reconstructed from the app's passwordless sign-in list
matches the pending sessions shown with their match codes

Approve passwordless sign-in session
POST /v1/signin/sessions/approve osint
Approves or denies a pending passwordless phone-sign-in session after the user confirms the number match or provides a FIDO assertion.
Auth: Authorization: Bearer access token. Form body carries a key assertion or a FIDO assertion (fidoassertion) plus sessionid, sessionstate, sessiontype and userobjectid.
- sessionid
- sessionstate
- sessiontype
- userobjectid
- assertion
- fidoassertion
- entropy
- oathcounter
- app_state
- deviceid
- success
```
POST /v1/signin/sessions/approve HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
Content-Type: application/x-www-form-urlencoded
client-request-id: 5e2a1c90-44bb-4d11-a0e1-77aa11bb22cc

sessionid=sess-01&sessionstate=approve&sessiontype=Passwordless&userobjectid=84b12a9c-0e33-4d1a-9f44-11aa22bb33cc&assertion=eyJhbGciOiJFUzI1NiJ9.example&entropy=14&oathcounter=48212
```
```
{
  "success": true
}
```
- reconstructed from the app's number-match confirmation
- matches the signed assertion posted to complete phone sign-in

Register device sign-in key

POST /v1/devices/keys osint

Registers the device's public sign-in key with the device-registration service so the handset can later approve passwordless sessions.

Auth: Authorization: Bearer token scoped for device registration. Sends an api-version query parameter plus client name and SKU headers.

publicKeyCredential
credentialDisplayName
attributes
supports_notification
message
time
requestId
serverKeyId

POST /v1/devices/keys?api-version=1.1 HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
Content-Type: application/json
X-Client-Name: AuthenticatorAndroid
X-Client-SKU: authenticator.android

{
  "publicKeyCredential": {
    "id": "cred-aa11",
    "rawId": "Y3JlZC1hYTEx",
    "type": "public-key",
    "response": {
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10",
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0"
    }
  },
  "credentialDisplayName": "Pixel 8",
  "attributes": {
    "supports_notification": "true"
  }
}

{
  "message": "Key registered",
  "time": "2026-09-29T12:05:01Z",
  "requestId": "drs-req-01",
  "serverKeyId": "key-8e21c0"
}

reconstructed from the app's passwordless setup flow
matches the public key and attestation uploaded during device key registration

Delete device sign-in key
DELETE /v1/devices/keys/{keyId} osint
Removes the device sign-in key from the registration service when the work account is deleted or passwordless phone sign-in is turned off.
Auth: Authorization: Bearer device-registration token. The app resolves the deletion route from discovery metadata and appends an api-version query parameter.
- keyId
- upn
- krctx
```
DELETE /v1/devices/keys/key-8e21c0?api-version=1.0 HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.example
X-Client-Name: AuthenticatorAndroid
X-Client-SKU: authenticator.android
```
```
{
  "keyId": "key-8e21c0",
  "upn": "[email protected]",
  "krctx": "ctx-01"
}
```
- reconstructed from the app's work-account removal flow
- matches the key cleanup issued when passwordless sign-in is disabled

Where teams use this data

Workforce MFA device inventory
Read AccountName, PhoneAppDetailId, DeviceName and TenantCountryCode from each device registration plus the DeviceToken rotation events to reconcile which handsets are enrolled as Microsoft Authenticator methods.
Number-match and location policy checks
Pull numberMatchingRequiredState, displayLocationInformationRequiredState and isSoftwareTotpEnabled from the per-user authenticator policy and compare them with firstEntropyNumber and returnLocationData on the live MFA challenge.
Passwordless session monitoring
Watch the pending-sessions list for passwordless sign-ins (username, sessionType, authDetails, fidoChallenge) and complete them with a signed assertion after the user confirms the match code.
Passkey lifecycle on Entra ID
Read passkey creation options, store a platform passkey for the user from its attestation, and remove authenticator or passkey methods when the device is retired.

Frequently asked questions

How does Microsoft Authenticator enroll a work or school account?

The app posts a device registration to /v1/mfa/devices/register with a Bearer token, app and device headers, and an XML body carrying DeviceName, DeviceToken and NotificationType. The response returns AccountName, GroupKey, OathSecret and PhoneAppDetailId plus the tenant routing hints used by later calls.

How are push MFA approvals requested and submitted?

The phone polls /v1/mfa/challenges/poll for a waiting sign-in, loads the challenge from /v1/mfa/challenges/context (firstEntropyNumber digits, sasSessionId, richContextDetails), then posts the decision to /v1/mfa/challenges/result with authenticationResult, isAppLockUsed and oathTokenCounter. When policy requires it, /v1/mfa/challenges/pin validates the app PIN first.

What does the authenticator policy data include?

GET /v1/accounts/{id}/mfa-policy returns the per-user authenticator settings: authenticationMode, numberMatchingRequiredState, displayLocationInformationRequiredState, isSoftwareTotpEnabled and companionAppAllowedState. A separate tenant call, /v1/tenants/security-defaults, reports whether identity security defaults are enabled.

How do passkeys and passwordless sign-in work in the app?

Pending passwordless sessions are listed at /v1/signin/sessions (sessionId, entropy digits, fidoChallenge) and completed at /v1/signin/sessions/approve with a signed assertion. Passkey setup reads options from /v1/accounts/{id}/passkeys/creation-options and stores the credential with POST /v1/accounts/{id}/passkeys; a DELETE on the same resource retires it.

Apps similar to Microsoft Authenticator

Google Authenticator — Google's free authenticator app generates TOTP and HOTP one-time codes for Google and third-party accounts, with optional sync to a Google account.
Twilio Authy — Twilio's two-factor app offers encrypted cloud backups and multi-device sync so codes survive a phone change.
Duo Mobile — Cisco's workforce MFA app handles push approvals and pairs with Duo's risk-based authentication, SSO and device-visibility platform.
Okta Verify — Okta's workforce identity app sends push approvals for Okta-managed accounts and is listed among Microsoft Authenticator's direct competitors.
Aegis Authenticator — A free, open-source Android authenticator that stores tokens in an encrypted local vault and collects no user data.
2FAS Auth — An open-source authenticator that works offline without requiring an account, with an optional browser extension for quicker sign-ins.
Ente Auth — An open-source authenticator from Ente with end-to-end encrypted backups that sync codes across mobile and desktop.

More Identity apps

Topics

Microsoft Authenticator API
MFA push approval API
authenticator device registration
number matching MFA
passwordless phone sign-in
FIDO2 passkey registration API
OathSecret PhoneAppDetailId
authenticator policy API

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

NDA + SOW on every engagement
Delivery in 3–7 days
Payment only after acceptance
Work scoped to authorized use

Get a quote

Microsoft Authenticator data API: MFA, passkeys and passwordless sessions

Screenshots

API surface

Issue an OAuth 2.0 access token

Register Authenticator as MFA method

Discover MFA service endpoints

Poll pending MFA notifications

Fetch MFA challenge context

Submit MFA approve or deny

Validate MFA PIN on approve

Rotate push device token

Read authenticator methods policy

Read security defaults tenant policy

Get FIDO2 passkey creation options

Register FIDO2 passkey

Delete Authenticator MFA method

Delete FIDO2 passkey method

Read organization data boundary

List passwordless sign-in sessions

Approve passwordless sign-in session

Register device sign-in key

Delete device sign-in key

Data categories

Where teams use this data

Workforce MFA device inventory

Number-match and location policy checks

Passwordless session monitoring

Passkey lifecycle on Entra ID

Frequently asked questions

Apps similar to Microsoft Authenticator

More Identity apps

Pak Identity

Налоги ФЛ

Topics

Need this app's data API integrated?

Microsoft Authenticator data API: MFA, passkeys and passwordless sessions

Screenshots

API surface

Issue an OAuth 2.0 access token

Register Authenticator as MFA method

Discover MFA service endpoints

Poll pending MFA notifications

Fetch MFA challenge context

Submit MFA approve or deny

Validate MFA PIN on approve

Rotate push device token

Read authenticator methods policy

Read security defaults tenant policy

Get FIDO2 passkey creation options

Register FIDO2 passkey

Delete Authenticator MFA method

Delete FIDO2 passkey method

Read organization data boundary

List passwordless sign-in sessions

Approve passwordless sign-in session

Register device sign-in key

Delete device sign-in key

Data categories

Where teams use this data

Workforce MFA device inventory

Number-match and location policy checks

Passwordless session monitoring

Passkey lifecycle on Entra ID

Frequently asked questions

Related apps

Apps similar to Microsoft Authenticator

More Identity apps

Pak Identity

Налоги ФЛ

Topics

Need this app's data API integrated?