Microsoft Authenticator to Wipe Entra Credentials on Compromised Phones

Microsoft is taking a new step to protect enterprise identities: starting February 2026, its Authenticator app will automatically remove all Microsoft Entra ID credentials from any mobile device detected to be jailbroken or rooted. The proactive defense aims to shut down a common attack avenue where threat actors exploit weakened phones to hijack multi-factor authentication (MFA) sessions.

Jailbreaking (on iPhones) and rooting (on Android) unlock deeper control of a device’s operating system at the expense of built-in security. Microsoft’s move declares that if a device is not in a known-secure state, it cannot store the keys to corporate accounts. The Authenticator app will periodically check device integrity; if compromised, any stored Microsoft Entra (formerly Azure AD) account credentials will be wiped immediately across iOS and Android, without special admin policies.

For organizations, the change has immediate implications. Employees with modified devices will find their work or school accounts removed from Authenticator. Helpdesks may see inquiries, and IT departments may mandate compliance checks or provide managed devices for those who need to use Authenticator.

The approach aligns with Zero Trust principles: never trust an endpoint just because it’s been used before. Device health joins user credentials and location as factors to consider. Other identity providers and MFA app makers will watch this closely; if it reduces MFA compromise incidents, similar features could become standard. Users with personal Microsoft accounts should note the wipe affects only work or school Entra accounts; personal Microsoft accounts and third‑party OTPs in Authenticator will not be touched.

Source: Microsoft Support

—

By the ID Tech Editorial Team