A rooted or jailbroken phone is a bad place to keep the second factor that protects everything else. The whole security model of Authenticator assumes the OS underneath it is intact; on a compromised device, that assumption is gone. Authenticator now enforces it directly.
What it does
On jailbroken (iOS) or rooted (Android) devices, Microsoft Authenticator blocks users from adding or using work or school accounts. If the device is compromised, the work account simply won’t operate in the app — the user has to move to a healthy device to carry on.
Two things make this better than the usual security control:
- Secure by default — it’s on. There’s no admin configuration, no policy to author, no rollout to plan.
- No Intune dependency — you don’t need the device enrolled for this to apply. It’s baked into the app, so it covers BYOD and unmanaged devices that your compliance policies never see.
Why the “no enrolment” part matters
Most device-health enforcement runs through Intune compliance, which means it only applies to devices you manage. The gap has always been the unmanaged phone with a work account in Authenticator — exactly the device most likely to be jailbroken and least likely to be enrolled. Building the check into Authenticator itself closes that gap for free.
There’s nothing to do here except know it exists — so when a user on a rooted phone reports that they “can’t add their account”, you recognise it immediately as working as intended, not a bug.
Source: Microsoft Learn. Summarised independently — check the source for the latest detail.