One leaked password is trouble enough; what an authenticator does is make that one leak insufficient.

Why the phone became the second key

The route to a stolen account is usually plain. A password leaked somewhere, and someone tried it elsewhere. Multi-factor authentication blocks that road by asking for one more confirmation beyond the password, and that confirmation is produced by a device carried on the person.

Microsoft Authenticator is the company's own verification app for phones, described on the product page as a tool for verifying across apps and across accounts. One detail in that positioning is worth noticing: the accounts it accepts are not limited to Microsoft's own. Personal, work, school and other providers' accounts can all sit in the same list. In other words it behaves like a general authenticator rather than an accessory to one account system.

Several ways of confirming who you are

The most used is the push approval. Enter the password at sign-in, a prompt arrives on the phone, and one tap finishes the check. The official wording for this mechanism is plain: it adds a layer of protection to signing in, and is commonly called two-step or multi-factor verification.

The second is a one-time passcode. The app carries a security code generator that rolls on a timer, and the official note points out that these codes still work while the device is offline. Treating it as the fallback is the most accurate reading: when the network is down or the push never arrives, typing those digits still gets the sign-in done.

The third leans on the device itself. The app can register a phone as a trusted device and let a certificate do the confirming, a path more often seen with accounts inside an organisation. Running three routes in parallel buys tolerance: if one is temporarily unusable, another door remains.

A fourth use is more thorough, namely signing in without a password. The official page puts multi-factor and passwordless side by side in its opening paragraph, and the latter removes the password step entirely, leaving only the confirmation on the device. It suits anyone tired of typing passwords, on the condition that the device-side channel is set up first.

Free, and where its platform edge sits

The app is free in both stores. The Android listing shows more than a hundred million installs and a rating holding around four point six; the Apple listing returns a price field of zero as well. Free here is not a limited-time trial but the shape it has always had.

The platform boundary needs stating. The main body is a mobile app, and the official product page is titled a phone authenticator, so daily use cannot be separated from a phone. A distribution for Windows also exists in the Microsoft Store, but treating that as a standalone desktop authenticator would be a misreading.

Two habits are worth settling before setup. The first is switching phones and reinstalling: the authenticator is tied to the device, so the migration steps have to be finished before the old phone goes away, otherwise the confirmation channel on it simply ends. The second is a backup route: keep at least one alternative, a one-time passcode or a second registered device, so that a single blocked entrance does not leave you outside.

An authenticator answers the question of who you are, which is reason enough to configure it carefully once and then leave it alone.

A workable order: add the work or school account first and confirm that pushes arrive, then bring in accounts from other platforms; keep a set of one-time codes as the fallback, and go through the list now and then to clear out accounts no longer in use.