Scan results

Recommendation: Acceptable with Privacy Awareness

Essential for Microsoft accounts, but includes an older two-factor code storage method alongside newer encrypted storage, and sends location and organizational data to Microsoft through telemetry that cannot be fully disabled. Privacy-conscious users should review Microsoft's data collection practices before relying on this app for non-Microsoft accounts.

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 1 finding (1 low)

Code Safety - 3 findings (2 low, 1 info)

Privacy - 4 findings (2 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

• Account identifiers: organizational tenant ID and a persistent install identifier tied to your device
• Location data: GPS precision, accuracy in meters, and location timing during sign-in events
• Usage data: sign-in activity, MFA authentication events, app interactions
• Device information: device ID, operating system, account count metrics

Third-Party Data Sharing

The following third parties may receive your data:

• Microsoft ARIA / OneDS - sign-in activity, location precision data, organizational tenant ID, and persistent device identifier via required telemetry
• Microsoft AppCenter - crash reports that automatically include account identifiers without user review
• Azure AI Vision (Microsoft) - camera frames transmitted to Microsoft's cloud during optional identity verification flows only
• Google (Firebase Cloud Messaging) - push notification delivery for authentication prompts

Understanding the Scores

Security: 89/100
Privacy: 30/100

Security Breakdown

• Data Security: 90/100 - Strong hardware-backed key storage for most secrets, though an older storage path retains unencrypted two-factor codes alongside newer encrypted ones
• Network Security: 95/100 - Core authentication traffic restricted to system-trusted authorities; base configuration extends broader trust to unlisted domains
• Code Safety: 94/100 - Robust browser and link-handling controls; minor issues with a profiling flag left in the production build and an older encryption algorithm used for device registration certificates

Privacy Breakdown

• Data Collection: 90/100 - Collects location and device identifiers with a clear optional/required distinction in the app's permission model
• Data Sharing: 100/100 - Data sharing is limited to Microsoft-owned services and Google push infrastructure
• User Control: 90/100 - Optional telemetry can be disabled, but a set of required telemetry events including location and organizational data cannot be turned off

Positive Security Features

• Authentication secrets are stored in hardware-backed secure storage with runtime verification that the device's secure chip is in use
• All app data is fully excluded from Android cloud backups and device transfers, preventing account data from leaving the device unintentionally
• Browser-based sign-in windows block file access across all three file access modes, preventing local file exposure
• The JavaScript bridge for Microsoft sign-in pages is dynamically restricted to Microsoft domains only
• Core Microsoft authentication servers are restricted to system-trusted authorities, blocking interception attempts on those connections
• Certificate installation links use exact-match validation, preventing unauthorized certificate installs via crafted links

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Opt-Out Coverage for Required Telemetry
   Currently, certain telemetry events including organizational tenant ID and location precision data are transmitted regardless of the user's optional telemetry preference. Extending user opt-out rights to cover these required events would better align with data minimization principles.

2. User Review Before Automatic Diagnostic Uploads
   Crash reports that include account identifiers are automatically submitted when the app crashes. Providing users with a review screen before transmission would give them meaningful control over what account-linked data is shared with Microsoft.

3. Explicit Disclosure of Location Data in Telemetry
   Location precision metrics are transmitted during authentication events even when location access was not required for that specific sign-in. Clear in-app disclosure of when and why location data is included in telemetry would improve transparency.

Security Enhancements

1. Remove Profiling Flag from Production Builds
   The app's production release includes a configuration flag that allows development tools to attach a profiler to the running app over a connected cable. This flag is intended for pre-release testing and should be removed from production releases.

2. Migrate Device Registration to Modern Encryption
   The Workplace Join device registration process uses an older encryption standard for protecting private keys in device certificates. Migrating to a current algorithm would bring this component in line with current industry standards.

3. Complete Migration Away from Legacy Two-Factor Code Storage
   The database retains a legacy column that stores two-factor authentication codes without the newer encryption protection applied to the primary column. Completing the migration by zeroing the legacy column after encryption would eliminate this residual exposure.

Technical Context

App Type: Multi-factor authentication and identity management, high sensitivity
Classes Analyzed: 31,000
Third-Party Services: 18
Context Tags: sensitive_data, location, camera, enterprise

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Microsoft Corporation
Version: 6.2603.1485
Analysis Date: 2026-04-17
Package: com.azure.authenticator

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 6.2603.1485 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors