Refer to this scribe guide if easier to interact with:

https://scribehow.com/page/Setup_Guide_Enabling_Google_Authenticator_for_an_MS365_Org_through_Entra__4Bga1zmmQDu7NrgOK858nA

Configuring Third-Party OATH TOTP Applications for Multi-Factor Authentication

This guide provides instructions for enabling and configuring third-party authenticator apps (such as Google Authenticator or Authy) as a secondary sign-in method for Microsoft 365 accounts through Entra. This is an alternative for users who prefer not to use the Microsoft Authenticator app.

Target Audience: This document includes both administrative configuration steps (for IT staff) and end-user setup instructions.

Before users can add a third-party app, the Microsoft Entra ID tenant must be configured to allow “Software OATH tokens.”

1. Enable OATH Tokens

  1. Log in to the Microsoft Entra admin center.
  2. Navigate to Protection > Authentication methods > Policies.
  3. Select Software OATH tokens.
  4. Set the Enable toggle to On.
  5. In the Target tab, select the appropriate groups or All users.
  6. Click Save.

2. Resolving “Missing Link” Issues

If users report they cannot see the option for “Different authenticator app,” check the following settings:

  • Registration Campaign:
    • Navigate to Authentication methods > Registration campaign.
    • If state is set to Microsoft Managed, Microsoft may hide other options to force the use of the Microsoft app. Consider just setting to “Enabled” or adding an exclusion for specific users during setup.
  • System-preferred MFA:
    • Navigate to Authentication methods > Settings.
    • If enabled, Entra ID will automatically skip selection screens to prompt for the most secure method found. This is preferred to leave enabled to make sure strongest MFA method is selected, but if it causes issues, switch to “Disabled”