# Security & Privacy Scorecard

## Microsoft Authenticator

## What This Means for You

Your sign-in activity, location precision data, and a persistent device identifier are sent to Microsoft's analytics service on every authentication, and you cannot opt out of this required telemetry.

## Recommendation: Acceptable with Privacy Awareness

Essential for Microsoft accounts, but includes an older two-factor code storage method alongside newer encrypted storage, and sends location and organizational data to Microsoft through telemetry that cannot be fully disabled. Privacy-conscious users should review Microsoft's data collection practices before relying on this app for non-Microsoft accounts.

**Best For:** Enterprise and personal Microsoft account users who need multi-factor authentication and are comfortable with Microsoft's telemetry practices

## Key Findings

**Data Security** - 1 finding (1 medium)

**Network Security** - 1 finding (1 low)

**Code Safety** - 3 findings (2 low, 1 info)

**Privacy** - 4 findings (2 medium, 1 low, 1 info)

## Privacy Concerns

### What Data is Collected

- Account identifiers: organizational tenant ID and a persistent install identifier tied to your device
- Location data: GPS precision, accuracy in meters, and location timing during sign-in events
- Usage data: sign-in activity, MFA authentication events, app interactions
- Device information: device ID, operating system, account count metrics

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Microsoft ARIA / OneDS - sign-in activity, location precision data, organizational tenant ID, and persistent device identifier via required telemetry
- Microsoft AppCenter - crash reports that automatically include account identifiers without user review
- Azure AI Vision (Microsoft) - camera frames transmitted to Microsoft's cloud during optional identity verification flows only
- Google (Firebase Cloud Messaging) - push notification delivery for authentication prompts

## Understanding the Scores

**Security:** 89/100
**Privacy:** 30/100

### Security Breakdown

- **Data Security:** 90/100 - Strong hardware-backed key storage for most secrets, though an older storage path retains unencrypted two-factor codes alongside newer encrypted ones
- **Network Security:** 95/100 - Core authentication traffic restricted to system-trusted authorities; base configuration extends broader trust to unlisted domains
- **Code Safety:** 94/100 - Robust browser and link-handling controls; minor issues with a profiling flag left in the production build and an older encryption algorithm used for device registration certificates

### Privacy Breakdown

- **Data Collection:** 90/100 - Collects location and device identifiers with a clear optional/required distinction in the app's permission model
- **Data Sharing:** 100/100 - Data sharing is limited to Microsoft-owned services and Google push infrastructure
- **User Control:** 90/100 - Optional telemetry can be disabled, but a set of required telemetry events including location and organizational data cannot be turned off

## Positive Security Features

- Authentication secrets are stored in hardware-backed secure storage with runtime verification that the device's secure chip is in use
- All app data is fully excluded from Android cloud backups and device transfers, preventing account data from leaving the device unintentionally
- Browser-based sign-in windows block file access across all three file access modes, preventing local file exposure
- The JavaScript bridge for Microsoft sign-in pages is dynamically restricted to Microsoft domains only
- Core Microsoft authentication servers are restricted to system-trusted authorities, blocking interception attempts on those connections
- Certificate installation links use exact-match validation, preventing unauthorized certificate installs via crafted links

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Opt-Out Coverage for Required Telemetry**
   Currently, certain telemetry events including organizational tenant ID and location precision data are transmitted regardless of the user's optional telemetry preference. Extending user opt-out rights to cover these required events would better align with data minimization principles.

2. **User Review Before Automatic Diagnostic Uploads**
   Crash reports that include account identifiers are automatically submitted when the app crashes. Providing users with a review screen before transmission would give them meaningful control over what account-linked data is shared with Microsoft.

3. **Explicit Disclosure of Location Data in Telemetry**
   Location precision metrics are transmitted during authentication events even when location access was not required for that specific sign-in. Clear in-app disclosure of when and why location data is included in telemetry would improve transparency.

### Security Enhancements

1. **Remove Profiling Flag from Production Builds**
   The app's production release includes a configuration flag that allows development tools to attach a profiler to the running app over a connected cable. This flag is intended for pre-release testing and should be removed from production releases.

2. **Migrate Device Registration to Modern Encryption**
   The Workplace Join device registration process uses an older encryption standard for protecting private keys in device certificates. Migrating to a current algorithm would bring this component in line with current industry standards.

3. **Complete Migration Away from Legacy Two-Factor Code Storage**
   The database retains a legacy column that stores two-factor authentication codes without the newer encryption protection applied to the primary column. Completing the migration by zeroing the legacy column after encryption would eliminate this residual exposure.

## Technical Context

**App Type:** Multi-factor authentication and identity management, high sensitivity
**Classes Analyzed:** 31,000
**Third-Party Services:** 18
**Context Tags:** sensitive_data, location, camera, enterprise

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Microsoft Corporation
**Version:** 6.2603.1485
**Analysis Date:** 2026-04-17
**Package:** com.azure.authenticator

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 6.2603.1485 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors