Microsoft Authenticator Blocks Rooted and Jailbroken Devices

Microsoft is rolling out a significant update to the Authenticator app that will detect and eventually block access from rooted (Android) or jailbroken (iOS) devices. The move aims to enhance security, as modified operating systems can bypass protections and expose authentication data to malicious apps.

The Microsoft Authenticator app will be subject to a forced security update starting in late February 2026, which will limit its use on rooted (Android) and jailbroken (iOS) devices. 

In order to mitigate the security concerns connected with updated operating systems, this change specifically affects Microsoft Entra ID (work or school) credentials.

The update will roll out in three phases:

• Alert Mode: Users see warnings that their device is compromised, but access is still permitted.

• Block Mode: Users are prevented from using Authenticator for sign-ins or two-factor authentication (2FA).

• Clean Mode: The app automatically logs the user out and deletes all account data from the device.

The timeline for implementing the global rollout is anticipated to be finished by the middle of 2026. It started in late February 2026.

The Android rollout began in late February 2026 and is expected to conclude by mid-2026. The iOS rollout begins in April 2026, with the same completion target.

There is no option to opt out. The feature applies to Microsoft Entra (formerly Azure AD) users and will be fully enforced by June 2026.

Important information for businesses 

• No Opt-Out: This is a “secure-by-default” feature. Through the Microsoft Entra admin centre, IT managers are unable to turn off this detection or exclude particular users.
• Personal Accounts Unaffected: Neither third-party 2FA accounts stored in the app nor personal Microsoft accounts (such as Outlook.com and Hotmail) are impacted by the crackdown.

No Admin Action Needed: Microsoft Intune or Certain Conditional Access policies are not necessary for the detection to work because it is integrated right into the app layer.