{"slug": "exporting-microsoft-authenticator-totp-secrets", "title": "Exporting Microsoft Authenticator TOTP secrets", "summary": "The article explains that Microsoft Authenticator uses a proprietary scheme called phonefactor for Office 365 TOTP 2FA, preventing the use of standard TOTP apps. However, after registration, the app generates codes using regular otpauth, and the secrets can be extracted from a rooted Android device's SQLite database at `/data/data/com.azure.authenticator/databases/PhoneFactor`. The extracted 32-character `oath_secret_key` can then be imported into any standard TOTP application.", "body_md": "# Background\n\nWorkplaces may enforce TOTP 2FA to be enabled Office 365 accounts, which require the [Microsoft Authenticator](https://www.microsoft.com/en-us/security/mobile-authenticator-app) app to be installed. \n\nRegular TOTP applications (such as [Aegis](https://getaegis.app/), [Authy](https://authy.com/), or [LastPass](https://www.lastpass.com/)) cannot be used as Microsoft uses a proprietary scheme called `phonefactor`. Furthermore, the application requires Google Services Framework (GSF) to be installed (likely to provide device notifications), and will refuse to work when it is not present on the device.\n\nForunately, after the registration is complete, the underlying mechanism the app uses to generate TOTP codes is regular `otpauth`, and its secrets can be exported with a little bit of effort. \n\n# Extracting the keys \n\n1. To extract the keys, a complete registration must first be done with a **rooted** Android device. I used a virtual Android device created with [Android Studio's Device Manager](https://developer.android.com/studio/run/managing-avds).\n\n2. Once complete, an SQLite database storing the keys can be found on the device at: \n\n    `/data/data/com.azure.authenticator/databases/PhoneFactor` \n    \n    (accessing the `/data` partition is what requires root) \n\n3. [ADB](https://developer.android.com/studio/command-line/adb) can then be used to connect to the device/emulator, using its bundled `sqlite3` tool to view the database:\n\n    ```\n    $ adb root  # Ensure we run as the root user \n    $ adb shell  # Launch a shell as the root user \n    emu64xa:/ # whoami\n    root \n    emu64xa:/ # sqlite3 /data/data/com.azure.authenticator/databases/PhoneFactor  # Connect to the database file\n    sqlite> SELECT name, username, oath_secret_key from accounts;\n    GitHub|Chowder@github.com|w0swofa8wl02vqml0pkbzphvp54zyx5x\n    ```\n    The 32-length string in the `oath_secret_key` column can then be imported into any TOTP application.", "url": "https://wpnews.pro/news/exporting-microsoft-authenticator-totp-secrets", "canonical_source": "https://gist.github.com/chowder/2ead734d60d84d4d15034fcce81aaaf9", "published_at": "2023-02-21 00:00:39+00:00", "updated_at": "2026-05-23 03:06:22.837164+00:00", "lang": "en", "topics": ["cybersecurity", "developer-tools", "open-source"], "entities": ["Microsoft Authenticator", "Aegis", "Authy", "LastPass", "Google Services Framework", "Android Studio", "ADB", "SQLite"], "alternates": {"html": "https://wpnews.pro/news/exporting-microsoft-authenticator-totp-secrets", "markdown": "https://wpnews.pro/news/exporting-microsoft-authenticator-totp-secrets.md", "text": "https://wpnews.pro/news/exporting-microsoft-authenticator-totp-secrets.txt", "jsonld": "https://wpnews.pro/news/exporting-microsoft-authenticator-totp-secrets.jsonld"}}