In many of the Microsoft 365 environments I work in, news of the Authenticator autofill retirement caused real confusion. The users hit hardest were those who had relied on the Microsoft Authenticator app to fill in passwords and addresses on their phones. The timeline is fixed. From June 2025 the app no longer saves new passwords, in July autofill stops working altogether, and by August saved passwords can no longer be accessed in Authenticator. Anyone who got used to that convenience will have to change their habits.

The retirement removes only the password and address autofill in Authenticator

To be precise about scope, this change only touches the password and address autofill feature in Authenticator that syncs with personal Microsoft accounts. Entra MFA, passkeys and work accounts are not affected. Users who kept personal logins in Authenticator will run into limits soon: saving new passwords ends in mid-June 2025, autofill itself stops in mid-July, and from August the stored passwords are gone from the app.

The cloud backend stays in place, though. Passwords and addresses keep syncing via the user's Microsoft account to Microsoft Edge. Microsoft's advice is unambiguous: anyone who wants autofill should move to Edge or export their data. Most organisations never used Authenticator autofill for corporate identities, but I still see users caught off guard on BYOD or dual-use devices. So this is a sensible time to look at what Edge's password manager offers, particularly for personal accounts (Microsoft Edge: Password Manager Security).

The retirement mostly affects organisations through their password manager policies

In the projects I've worked on, I have only seen Authenticator autofill used for personal logins. Entra ID work accounts never supported the feature, and organisations cannot manage or recover passwords that a user saved in their personal Microsoft account through Authenticator. Even so, the retirement is a good reason to revisit your password manager policy and make sure users know what is allowed on corporate devices, above all in BYOD or mixed-use setups.

These points need to be communicated clearly:

  • Is the use of personal password managers (Edge, 1Password, etc.) allowed, prohibited or regulated?
  • Which solution is recommended or required for business logins?
  • How should users keep private and corporate credentials apart?

My practical tip: You don't have to roll out an enterprise password manager to everyone. You do need a clear policy on what is allowed and recommended, and people need to actually know about it. That saves you headaches and security escalations further down the line.

Early user communication prevents password loss and confusion

The change sits entirely on the personal side, but telling users in advance avoids frustration and, in the worst case, lost passwords. A short note in the newsletter or on the intranet is usually enough: "Microsoft is removing password autofill from the Authenticator app. From August 2025, passwords will no longer be visible in the app. Please export your data beforehand or use Microsoft Edge to continue managing your private passwords."

Exporting stored passwords is simple. In the Authenticator app, go to Settings → Passwords → Export and save the CSV file. As an alternative, users can sign in to Microsoft Edge with their Microsoft account and sync their passwords there. Microsoft's official instructions are in the Authenticator app documentation.

Authenticator remains the core app for MFA and passkeys

Because of the autofill retirement, some users assume the Authenticator app is going away for company MFA or passkeys as well. It isn't. The app is still needed for Entra MFA, push approvals and passkey sign-ins, exactly as before (see Passkeys in Microsoft Authenticator: Entra ID preview). Only personal password management is affected, and that was never meant for corporate sign-ins in the first place.

This simple diagram shows how the pieces relate:

flowchart LR
    Authenticator["Authenticator app"] -->|"MFA, passkeys"| EntraID["Entra ID (work login)"]
    Authenticator -->|"Autofill, passwords"| MSAccount["Personal Microsoft account"]
    MSAccount -->|"Sync"| Edge["Microsoft Edge password manager"]

Figure: MFA and passkeys always go through Entra ID, whereas autofill was tied only to personal Microsoft accounts and synced with Edge.

I see this as a good moment to set clear password manager rules

The Authenticator autofill retirement won't disrupt day-to-day business. It is, however, a useful reminder to settle how password managers may be used (and perhaps to start taking passkeys seriously). If your organisation has no password manager policy yet, now is the time to write one. Communicate it clearly and help users through the transition, and you'll avoid confusion while keeping authentication both secure and easy to use.