Authenticator app
An authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve. Cyber Essentials counts 'an app on a trusted device' as one of four accepted additional MFA factors, which helps meet A7.16 and A7.17.
- Term
- Authenticator app
- Also known as
- MFA app, Microsoft Authenticator, Google Authenticator, TOTP app
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.14A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term authenticator app mean in Cyber Essentials?
An authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
How does authenticator app apply to Cyber Essentials?
In plain terms
After you type your password, the service asks for one more thing that only your phone can give. Either you open the app and type the code it shows, or a message pops up asking "Is this you signing in?" and you tap approve. A stolen password on its own is then not enough. Common examples are Microsoft Authenticator and Google Authenticator.
What Cyber Essentials asks
The NCSC requirements say "authentication to cloud services must always use MFA" and list four types of additional factor: "a managed/enterprise device", "an app on a trusted device", "a physically separate token" and "a known or trusted account". An authenticator app is the second. The requirements also describe push notifications as "A prompt on a smartphone to approve or deny a login attempt", and list codes from "a mobile app" as one-time codes.
A7.14 asks whether all your cloud services offer MFA, and its guidance lists "a notification from an authentication app" as an example. A7.16 and A7.17 ask whether MFA is applied to all administrators and all users. A No to either is an automatic fail. The requirements also recommend alternatives to SMS where they work for you, and an app is one.
Practical points
- Plan for lost or replaced phones before it happens, so nobody has MFA switched off while they wait.
- The requirements say factors should be "usable and accessible". If some staff cannot use a phone app, a physical token is another accepted factor type.
- At Cyber Essentials Plus, test case 4 checks that a user and an administrator are prompted for MFA on each authentication service.
See MFA on cloud services and A7.17. Related: multi-factor authentication, SMS verification codes, passkey.
Related terms
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
Frequently asked questions
An authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
In the 2026 Danzell question set, authenticator app comes up at A7.14, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Authenticator app relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.