Microsoft is rolling out a brand new backup system in September for its Authenticator app on iOS, eradicating the requirement to make use of a Microsoft private account to again up TOTP secrets and techniques and account names.
Beforehand, the Microsoft Authenticator app required iOS customers to sign up with a private Microsoft Account to allow backups, no matter whether or not they have been utilizing the app for private or enterprise credentials.
This created issues in enterprise environments the place organizations typically prefer to preserve private and company knowledge separated.
The brand new backup system will proceed to make use of the signed-in iCloud account to retailer the backups, however now not with the requirement to make use of a Microsoft account. If the corporate makes use of a managed Apple ID on their company gadgets, then that will probably be used as a substitute of a private account.
Microsoft says this new characteristic will start rolling out in September and will probably be completed by early October 2025, with customers being proven a notification concerning the new expertise within the app, as proven under.
Supply: Microsoft
Microsoft says this characteristic will solely be obtainable to customers operating iOS 16.0 or later with iCloud and iCloud Keychain enabled. As soon as put in, account names and TOTP credentials (secrets and techniques) will probably be backed as much as iCloud and restored mechanically on new gadgets once you use the identical Apple account..
“Account names for all accounts within the Authenticator app—together with work or faculty accounts, Microsoft private accounts, and non-Microsoft accounts (comparable to Amazon, Google)—will probably be securely backed up utilizing iCloud and iCloud Keychain,” reads the Microsoft announcement.
The corporate stresses that solely TOTP secrets and techniques will probably be backed up and no different credentials, and that customers can disable the backup characteristic by the iCloud settings on their machine.
Microsoft says that this characteristic will mechanically roll out to all customers with no admin motion required.
The characteristic comes after Microsoft’s current announcement they’re eradicating the password autofill and administration performance from Authenticator.
Whereas cloud assaults could also be rising extra subtle, attackers nonetheless succeed with surprisingly easy methods.
Drawing from Wiz’s detections throughout hundreds of organizations, this report reveals 8 key methods utilized by cloud-fluent menace actors.