Microsoft 365 contains business-critical information such as email, contacts, documents, OneDrive data, SharePoint files and administrative controls. A compromised Microsoft 365 administrator account can therefore become a serious security incident.

A password alone should not be considered sufficient protection for an important Microsoft 365 account. Multi-Factor Authentication (MFA), commonly called Two-Factor Authentication (2FA), adds another verification factor after the password.

Microsoft 365 supports several authentication methods, including Microsoft Authenticator, passkeys/FIDO2, SMS, voice calls, hardware OATH tokens and software OATH/TOTP applications.

One useful option for organizations already using Google Authenticator is to configure a Microsoft 365 work account in Google Authenticator. Microsoft Entra ID supports third-party applications that generate standards-based OATH TOTP codes.

This article explains how Microsoft 365 Business Basic administrators can enable the appropriate authentication policy, register Google Authenticator using a QR code, test the configuration safely, and understand what the various Microsoft authentication options actually mean.

1. What Is 2FA/MFA?

Traditional authentication normally requires:

Username + Password

MFA adds another authentication factor.

For example:

Username + Password + Authenticator verification

Therefore, even if an attacker obtains the user's password, the attacker may still be unable to access the Microsoft 365 account without satisfying the additional authentication requirement.

Microsoft states that Security Defaults provide baseline identity protection and require MFA registration and MFA for administrators, among other protections.

2. 2FA vs MFA – Is There a Difference?

The terms are often used interchangeably, but technically:

2FA – Two-Factor Authentication

Uses exactly two authentication factors.

MFA – Multi-Factor Authentication

Uses two or more factors.

Microsoft generally uses the term MFA.

For a normal Microsoft 365 login, an example would be:

1. Something you know – your password.
2. Something you have – your authenticator application/device.

3. Does Microsoft 365 Business Basic Support MFA?

Yes.

Microsoft lists MFA through Security Defaults as available for Microsoft 365 Business Basic, Business Standard and Business Premium. Microsoft describes Security Defaults as suitable for many organizations, while more advanced Conditional Access capabilities are associated with higher licensing/security capabilities.

Therefore, you do not necessarily need Microsoft 365 Business Premium simply to obtain basic MFA protection for Business Basic users.

4. Can Google Authenticator Be Used with Microsoft 365?

Yes, provided the appropriate authentication method is permitted by your Microsoft Entra configuration.

Google Authenticator and similar applications generate TOTP – Time-Based One-Time Passwords.

Microsoft Entra supports OATH TOTP, an open standard for generating time-based OTP codes. Microsoft specifically documents that third-party applications using OATH TOTP can be used.

The basic process is:

Microsoft 365 account

↓

Microsoft Entra ID

↓

Software OATH/TOTP registration

↓

QR code

↓

Google Authenticator

↓

Rotating verification code

↓

Microsoft 365 MFA verification

5. What Is OATH TOTP?

OATH TOTP stands for:

Open Authentication – Time-Based One-Time Password

A secret key is shared between the authentication server and authenticator application during registration.

The authenticator then mathematically generates temporary verification codes.

Microsoft explains that software OATH applications receive a secret/seed and use it to generate OTPs. Third-party OATH TOTP applications can be used for this purpose.

A major advantage is that generation of a TOTP code normally doesn't require the phone to receive an SMS.

The phone therefore does not need mobile network reception merely to generate the current authenticator code.

6. Google Authenticator vs Microsoft Authenticator

Both applications can participate in MFA, but their Microsoft 365 capabilities are not identical.

Google Authenticator using TOTP

Typically provides:

• Rotating verification codes
• Standards-based TOTP authentication
• Offline code generation
• Support for accounts from many different providers

Microsoft Authenticator

Can additionally support Microsoft-specific capabilities such as:

• Push notifications
• Sign-in approval
• Verification codes
• Passwordless authentication
• Passkeys in supported configurations

Microsoft documents support for notifications, verification codes, passwordless sign-in and passkeys through Microsoft Authenticator.

Therefore, Google Authenticator is useful if you prefer a conventional TOTP application, but Microsoft Authenticator can provide a more integrated Microsoft experience.

7. Before Changing Anything – Important Administrator Precaution

If you are configuring MFA for a Microsoft 365 administrator account, do not immediately remove the authentication method that currently works.

First:

1. Enable the required authentication policy.
2. Register Google Authenticator.
3. Verify the TOTP code.
4. Test sign-in using an InPrivate/Incognito browser.
5. Confirm that administrator access works.
6. Only then consider changing old authentication methods.

An administrator locking themselves out of the tenant can create a serious recovery problem.

8. Open Microsoft Entra Admin Center

Sign in using an account with sufficient administrative privileges.

Use the official:

Microsoft Entra Admin Center

The interface may change over time, but you are looking for:

Entra ID → Authentication methods → Policies

Microsoft's current Authentication Methods Policy provides granular controls over different authentication technologies.

9. Understanding the Authentication Method Policies Screen

Depending on your tenant and Microsoft's current interface, you may see methods such as:

• Passkey (FIDO2)
• Microsoft Authenticator
• SMS
• Temporary Access Pass
• Hardware OATH tokens
• Software/third-party OATH tokens
• Voice call
• Email OTP
• Certificate-based authentication
• Verified ID
• QR code

It is extremely important not to assume that every option containing the words QR code relates to Google Authenticator.

It does not.

10. Which Setting Is Relevant to Google Authenticator?

For a third-party TOTP application such as Google Authenticator, the relevant technology is:

Third-party Software OATH / Software OATH tokens

Microsoft's Authentication Methods Policy separates OATH methods so administrators can control Microsoft Authenticator OTP, third-party software OATH applications and hardware OATH tokens independently.

Therefore, if the tenant's policy blocks third-party software OATH tokens, Google Authenticator may not be available for registration/use.

11. Do NOT Confuse "Software OATH Tokens" with "Hardware OATH Tokens"

These are different technologies.

Software OATH token

The OTP generator is software installed on a device.

Examples include compatible TOTP authenticator applications.

Hardware OATH token

This is a physical device that generates authentication codes.

Microsoft supports OATH TOTP hardware tokens as a separate authentication category.

Therefore:

Google Authenticator = Software-based OATH/TOTP

It is not a hardware token.

12. Do NOT Enable Microsoft's "QR Code" Policy Just Because You Need a QR Code

This is a particularly important point.

Microsoft Entra may display a separate authentication method called:

QR code

That does not mean "allow Google Authenticator to scan a QR code."

The QR image used while enrolling a TOTP authenticator is part of the authenticator registration process.

Therefore:

QR code shown during Google Authenticator setup

and

Microsoft Entra's QR Code authentication method

are not the same thing.

Do not enable unrelated authentication technologies simply because their names contain "QR code."

13. Enable the Software OATH/Third-Party OATH Policy

From:

Microsoft Entra Admin Center

navigate to:

Entra ID → Authentication methods → Policies

Select the relevant Software OATH tokens / Third-party software OATH tokens policy.

Enable it for the users who should be permitted to use third-party TOTP authenticators.

Microsoft's current documentation describes management of third-party software OATH tokens under Entra ID authentication methods and notes that administrators can control whether users can sign in using OTPs from third-party software OATH applications.

14. Should You Enable It for "All Users"?

You can, but this isn't always necessary.

For initial testing, a more conservative approach is:

Target only the required administrator or a small test group.

After successful testing, the organization can decide whether the authentication method should be available to additional users.

This minimizes the effect of configuration changes.

15. Save the Authentication Policy

After selecting the appropriate target users/groups:

Enable → Save

Do not disable the currently functioning authentication method at this stage.

16. Open Microsoft Security Info

Next, open the user's Security Info page.

Microsoft Security Info

This is where a Microsoft work/school account can manage authentication methods.

Microsoft Support directs work/school users to the Security Info page when configuring authenticator applications.

17. Add a New Sign-In Method

Click:

+ Add sign-in method

Depending upon the tenant's policies, Microsoft may offer options such as:

• Microsoft Authenticator
• Phone
• Hardware token
• Email
• App password
• Other allowed methods

The available list depends upon administrator configuration.

18. Select the Authenticator Setup

In Microsoft's current registration experience, you may initially need to choose:

Microsoft Authenticator

Do not assume this forces you to use Microsoft's app.

During the setup wizard, look for an option similar to:

I want to use a different authenticator app

Microsoft Support explicitly documents this option when a user wants to configure another authenticator application.

Select it.

19. Microsoft Displays a QR Code

Continue through the setup wizard.

Microsoft should display a QR code containing the information required to configure the TOTP application.

Important security warning:

Treat this QR code as sensitive information.

Do not:

• Email it unnecessarily
• Post it in a ticket
• Put it in public documentation
• Send screenshots of it through WhatsApp
• Store it in an unsecured location

Anyone obtaining the underlying TOTP secret could potentially generate the same authentication codes.

20. Add the Account to Google Authenticator

On your smartphone:

1. Open Google Authenticator.
2. Tap the + button.
3. Select Scan a QR code.
4. Point the phone camera at the QR code displayed by Microsoft.
5. Wait for the account to be added.

Google Authenticator should then begin generating a rotating numerical verification code for the Microsoft account.

21. Verify the TOTP Code

Microsoft will ask for a verification code.

Look at the current code in Google Authenticator.

Enter it into Microsoft's setup page.

If the code is accepted, the authenticator has been successfully synchronized with the Microsoft account.

22. Why Does the Code Keep Changing?

This is normal.

TOTP stands for:

Time-Based One-Time Password

The generated value is intentionally temporary.

Microsoft supports OATH TOTP codes with short refresh intervals; its documentation describes OATH tokens that refresh at intervals such as 30 or 60 seconds.

Therefore, never try to memorize the code.

When Microsoft asks for verification, simply open Google Authenticator and enter the currently displayed code.

23. Does Google Authenticator Require Internet Access?

Generally, the TOTP code itself is calculated locally using:

• The stored secret
• Current time
• The TOTP algorithm

Therefore, receiving an SMS or having mobile network coverage is not required merely to generate the current code.

However, accurate device time is important.

If the phone's clock is seriously incorrect, generated codes may fail.

For this reason, keeping automatic date and time enabled on the smartphone is recommended.

24. Test MFA Before Removing Anything

After completing registration, don't simply assume it works.

Open:

Chrome Incognito

or

Microsoft Edge InPrivate

Then sign in to Microsoft 365.

You should be able to complete authentication using the newly configured method when Microsoft requests MFA.

Test access to important administrative services as appropriate.

Only after successful testing should you consider removing obsolete authentication methods.

25. Will Google Authenticator Stop Microsoft Asking for OTP Again and Again?

No. This is an important misunderstanding.

Google Authenticator changes how you obtain the OTP.

Instead of receiving an SMS, for example, you can obtain a TOTP code from the authenticator application.

It does not mean:

"Microsoft will never request MFA again."

Microsoft may still challenge you based on security configuration and sign-in circumstances.

26. Why Might Microsoft Request MFA Again?

A new authentication challenge can occur for many reasons, including:

• Signing in from another computer
• Using another browser
• Private/Incognito browsing
• Browser cookies being deleted
• Security policies
• Administrator account requirements
• Changes to authentication state
• Sign-in risk/security events
• Session expiration
• Organizational authentication requirements

Therefore, repeated MFA requests are not automatically evidence of a configuration fault.

27. Security Defaults in Microsoft 365 Business Basic

For many smaller Microsoft 365 organizations, Security Defaults provide a baseline security configuration.

Microsoft states that Security Defaults include protections such as:

• Requiring users to register for MFA
• Requiring administrators to perform MFA
• Requiring MFA for users when necessary
• Blocking legacy authentication
• Blocking device code flow

 

Microsoft also identifies Security Defaults as suitable for many Microsoft 365 business organizations.

28. Email OTP Is Not Necessarily Your Microsoft 365 Login MFA

Administrators may notice Email OTP in the Authentication Methods Policy.

Do not automatically assume that enabling Email OTP means normal Microsoft 365 users can use email as their second factor for every sign-in.

Microsoft's security-information documentation notes that authentication methods can have different purposes and that not every method is usable for both two-factor verification and password reset.

Authentication policies should therefore be configured according to Microsoft's documented purpose for each method rather than simply enabling everything.

29. Do Not Enable Every Authentication Method

A common administrative mistake is:

"I'll enable all authentication methods so everything works."

This is generally poor security administration.

Instead, enable only the methods your organization actually requires.

For example, an organization might permit:

• Microsoft Authenticator
• Third-party TOTP authenticator
• FIDO2/passkeys

while restricting weaker or unnecessary methods according to its security requirements.

30. Microsoft Authenticator May Be Better for Some Users

Although Google Authenticator works well as a standards-based TOTP generator, organizations should understand its limitations.

Google Authenticator TOTP typically requires:

Open application → Read code → Enter code

Microsoft Authenticator can support:

Sign-in request → Approve

and in supported configurations can provide passwordless or passkey-based authentication.

Therefore, Google Authenticator should not automatically be considered "better." It is simply another option that may suit organizations already standardized on TOTP.

31. Consider Passkeys/FIDO2 for Higher Security

Modern identity security is increasingly moving away from passwords and manually entered OTPs toward phishing-resistant authentication.

Microsoft Entra supports FIDO2 security keys and passkey-related authentication methods.

For highly privileged administrator accounts, organizations should consider stronger phishing-resistant authentication where practical.

32. Administrator Account Best Practices

For Microsoft 365 Global Administrators and other privileged accounts:

• Always use MFA.
• Do not share administrator credentials.
• Avoid using a Global Administrator account for routine email/web browsing where possible.
• Maintain secure recovery options.
• Test new authentication methods before removing existing ones.
• Protect the phone containing the authenticator.
• Use screen lock/biometrics on the smartphone.
• Consider phishing-resistant authentication for critical administrators.
• Review sign-in activity periodically.
• Never publicly share authentication QR codes.

33. What Happens If the Phone Is Lost?

This is one of the most important considerations with authenticator-based MFA.

If the only registered MFA method exists on a lost or damaged phone, account recovery can become difficult.

For important accounts, maintain an appropriate recovery strategy and additional approved authentication method.

For administrator accounts, plan recovery before an emergency occurs.

34. What If Google Authenticator Codes Are Rejected?

Check the following:

Check 1 – Phone time

Enable automatic date/time and automatic time zone.

Check 2 – Use the newest code

If a code is about to expire, wait for the next one and enter it immediately.

Check 3 – Correct account

If Google Authenticator contains many accounts, make sure you are entering the code belonging to the correct Microsoft 365 account.

Check 4 – OATH policy

Verify that the third-party Software OATH authentication method remains permitted for the user.

Check 5 – Registration

If setup was incomplete, remove/re-register the method according to your organization's recovery procedures.

35. What If "Use a Different Authenticator App" Does Not Appear?

Check the Entra Authentication Methods Policy.

Go to:

Entra ID → Authentication methods → Policies

Verify that the applicable third-party Software OATH authentication method is allowed for the user.

Microsoft's modern Authentication Methods Policy separately controls third-party software OATH applications.

Also remember that the exact wording and placement of Microsoft Entra options can change as Microsoft updates its administration portals.

36. Why Does the Add Sign-In Method Screen Show "Hardware Token"?

Do not select Hardware Token merely because Google Authenticator is missing.

A hardware token is a physical authentication device.

Google Authenticator is a software application.

These are separate authentication methods in Microsoft Entra.

37. Why Is "App Password" Shown?

App passwords are primarily associated with older applications or scenarios that cannot properly handle modern authentication/two-step verification.

Microsoft documents app passwords as a separately managed security-info method when an organization's administrator permits them.

They should not be confused with Google Authenticator codes.

For modern Microsoft 365 applications, organizations should generally prefer modern authentication rather than designing new deployments around app passwords.

38. Complete Configuration Flow

The entire process can be summarized as:

Step 1

Sign in to Microsoft Entra Admin Center.

↓

Step 2

Open:

Entra ID → Authentication methods → Policies

↓

Step 3

Locate:

Software/Third-party OATH tokens

↓

Step 4

Allow the required user/group.

↓

Step 5

Save the policy.

↓

Step 6

Open:

Microsoft Security Info

↓

Step 7

Select:

Add sign-in method

↓

Step 8

Start authenticator registration.

↓

Step 9

Select:

I want to use a different authenticator app

↓

Step 10

Microsoft displays a QR code.

↓

Step 11

Open Google Authenticator.

↓

Step 12

Select:

+ → Scan a QR code

↓

Step 13

Scan Microsoft's QR code.

↓

Step 14

Enter the generated TOTP code into Microsoft.

↓

Step 15

Complete registration.

↓

Step 16

Test the login using an InPrivate/Incognito session.

↓

Step 17

Only after successful testing, review whether any obsolete authentication methods should be removed.

39. Security Comparison

Authentication Method	Typical Experience	Internet Needed to Generate Code?	Relative Security Consideration
Password only	Enter password	No	Weakest approach
SMS OTP	Receive SMS	Mobile service normally required	Better than password alone, but not preferred for high-security use
Voice call	Receive call	Phone connectivity required	MFA but generally not preferred when stronger methods are available
Google Authenticator TOTP	Enter rotating code	No for local code generation	Good standards-based MFA
Microsoft Authenticator OTP	Enter rotating code	No for local code generation	Good standards-based MFA
Microsoft Authenticator push	Approve sign-in	Normally yes	More convenient; protect against approval fatigue
FIDO2/passkey	Device/key authentication	Depends on implementation	Strong phishing-resistant option

The exact method chosen should reflect the organization's security requirements, licensing, device environment and recovery strategy.

40. Recommended Small-Business Configuration

For a typical small business using Microsoft 365 Business Basic:

Normal users

Use MFA and provide clear enrollment/recovery instructions.

Administrators

Require strong MFA and maintain carefully controlled recovery options.

Critical privileged accounts

Consider phishing-resistant authentication such as FIDO2/passkeys where practical.

Legacy applications

Review whether they support modern authentication instead of routinely relying on app passwords.

Authentication policy

Do not enable methods that the organization does not need.

FAQ

1. Can Google Authenticator be used with Microsoft 365 Business Basic?

Yes. Microsoft Entra supports third-party applications that generate OATH TOTP codes, provided the applicable authentication method policy permits their use.

2. Do I need Microsoft Authenticator?

Not necessarily for TOTP-based MFA. A compatible third-party OATH TOTP authenticator can be used when permitted by the organization's policy.

3. Which Entra setting is important for Google Authenticator?

Look for the policy controlling third-party Software OATH tokens under Microsoft Entra Authentication Methods.

4. Should I select Hardware OATH Token?

No, not for Google Authenticator. Hardware OATH refers to physical token devices.

5. Should I enable Microsoft's "QR code" authentication method?

Not merely because Google Authenticator uses a QR code during enrollment. Microsoft's QR Code authentication method and a TOTP enrollment QR image are different concepts.

6. Where do I add the authenticator?

Use Microsoft's Security Info page for the work/school account:

Microsoft Security Info

Microsoft Support documents this portal for adding authenticator methods.

7. Where is the administrator policy?

Use:

Microsoft Entra Admin Center

Then navigate to the Authentication Methods configuration for Entra ID.

8. Does Google Authenticator receive an SMS?

No. It generates a TOTP code locally.

9. Does Google Authenticator need internet connectivity to generate a TOTP?

Normally no. TOTP codes are generated locally from the stored secret and time.

10. Why does the code change repeatedly?

Because it is a time-based one-time password. Short-lived codes reduce the usefulness of a captured old code.

11. Will Google Authenticator stop Microsoft asking for MFA every time?

No. Google Authenticator changes the verification mechanism. Microsoft's session and security policies determine when MFA is required.

12. Can I use Google Authenticator and Microsoft Authenticator together?

Potentially yes, depending on your tenant's authentication policies and registered methods. Having an appropriate backup method can also improve recoverability.

13. Can I remove my old authentication method after adding Google Authenticator?

Test the new method first. This is particularly important for administrator accounts.

14. Can Microsoft 365 Business Basic use MFA?

Yes. Microsoft identifies Security Defaults/MFA as available for Business Basic.

15. What are Security Defaults?

Security Defaults are Microsoft's baseline identity-security configuration for organizations. They include MFA-related protections and blocking of certain legacy authentication scenarios.

16. Is Google Authenticator more secure than SMS?

TOTP authenticator applications avoid several weaknesses associated with SMS delivery, although stronger phishing-resistant options such as FIDO2/passkeys should be considered for highly privileged accounts.

17. Is TOTP phishing-proof?

No. A user can still potentially be tricked into entering a current TOTP code into a fraudulent sign-in page. This is one reason phishing-resistant methods such as passkeys/FIDO2 are important for high-value accounts.

18. What happens if my phone is stolen?

Use another previously configured recovery/authentication method and follow your organization's account-recovery procedure. Protect the authenticator phone with a PIN, password or biometrics.

19. Can the same QR code be shared with multiple people?

This should not be standard practice. The QR code contains enrollment information tied to the authentication secret. Authentication credentials should remain under the control of the authorized account holder.

20. Can I take a screenshot of the authenticator QR code?

Avoid storing or sharing screenshots. Treat the QR code/secret as sensitive authentication material.

21. Why isn't Google Authenticator shown by name?

Microsoft generally manages third-party authenticator applications according to the authentication standard they use—OATH TOTP—rather than providing a separate policy for every authenticator brand.

22. Why is Microsoft Authenticator shown but Google Authenticator isn't?

Microsoft Authenticator has native integration with Microsoft Entra. Third-party TOTP applications use the standards-based OATH software-token mechanism.

23. What does "I want to use a different authenticator app" mean?

It allows a compatible alternative authenticator application to be configured instead of Microsoft's app. Microsoft documents this option in its work/school account security setup.

24. What if my authenticator code is always invalid?

Check the phone's time, make sure you selected the correct account, use a fresh code, and verify that the authentication policy still permits the method.

25. Is a passkey better than TOTP for an administrator?

For high-value accounts, phishing-resistant authentication such as passkeys/FIDO2 is generally worth considering. Microsoft Entra supports FIDO2 security keys and related passwordless authentication capabilities.

Conclusion

Microsoft 365 Business Basic can be protected with MFA, and organizations are not necessarily limited to Microsoft Authenticator. Microsoft Entra supports standards-based OATH TOTP, allowing compatible third-party authenticator applications such as Google Authenticator to generate verification codes.

The most important administrative distinction is that Google Authenticator is associated with third-party Software OATH/TOTP authentication—not Microsoft's separate Hardware OATH or QR Code authentication methods.

A safe implementation sequence is:

Enable the appropriate Software OATH policy → register the authenticator → scan the QR code → verify the TOTP → test sign-in → retain a secure recovery method.

For administrator accounts, MFA should be treated as an essential security control rather than an inconvenience. Where practical, organizations should also evaluate modern phishing-resistant authentication such as FIDO2/passkeys for highly privileged accounts.

#Tags

#Microsoft365 #Microsoft365BusinessBasic #Office365 #MicrosoftEntra #EntraID #MFA #2FA #TwoFactorAuthentication #MultiFactorAuthentication #GoogleAuthenticator #MicrosoftAuthenticator #OATH #TOTP #SoftwareOATH #OATHToken #AuthenticatorApp #QRCode #Microsoft365Security #Office365Security #EntraSecurity #CyberSecurity #AccountSecurity #IdentitySecurity #Authentication #MicrosoftAdmin #Microsoft365Admin #GlobalAdministrator #AdminSecurity #SecurityDefaults #MicrosoftSecurity #OTP #OneTimePassword #VerificationCode #PasswordSecurity #Passwordless #Passkey #FIDO2 #SecurityKey #AuthenticatorSetup #MFASetup #2FASetup #BusinessEmailSecurity #CloudSecurity #IdentityProtection #MicrosoftBusiness #MicrosoftCloud #SecurityBestPractices #ITSecurity #Microsoft365Guide #TechnicalGuide