Microsoft Authenticator

Two different logins get mixed up on Webflow security threads, and the fix for each one is different. Protecting your own Webflow account is a setting you turn on today. Protecting the visitors who sign in to a site you built is a separate build, because Webflow's User Accounts feature was disabled on all sites on January 29, 2026, and its APIs went with it. Any tutorial that gates member pages with User Accounts describes a product that no longer exists. Custom code runs in the browser, so it cannot verify a second factor on its own.

Microsoft Authenticator covers both logins, by two different routes. It is a standard TOTP app, so it works as the second factor on your Webflow account login right away, on any plan. For site visitors it works through an identity provider you embed, such as Auth0 or Outseta, which owns the login and prompts for the Authenticator code.

IT admins securing team access to Webflow get the most from the first route. Agencies building gated client portals need the second, as do compliance teams in finance or healthcare. Developers who want programmatic control over enrollment and user records can work directly against Microsoft Graph and the Webflow Data API.

How to integrate Microsoft Authenticator with Webflow

What is Microsoft Authenticator? Microsoft Authenticator is a mobile app for Android and iOS that adds a second factor to sign-ins. It supports push notifications with mandatory number matching, OATH time-based one-time passwords (TOTP), passwordless phone sign-in, and passkeys. It ships as part of Microsoft Entra ID, and it has no embeddable widget and no standalone public API, so every website integration runs through an identity provider such as Entra ID or Auth0.

Sort the work by whose login you are protecting. Your Webflow account and your Workspace are Webflow's own surfaces, and Webflow's own controls cover them. The people who sign in to your published site are not Webflow users at all, so their login belongs to a third-party provider. None of it is an app install: the Webflow Marketplace lists no Microsoft Authenticator or Entra ID app.

The Microsoft Authenticator and Webflow integration supports five approaches:

• The Webflow account 2FA setting accepts any standard TOTP app, so Microsoft Authenticator protects your own login without integration work.
• Workspace SSO routes every team login through Microsoft Entra ID, where Conditional Access enforces Authenticator MFA.
• The identity provider embed adds Authenticator-compatible MFA to visitor login through a hosted script, with no auth system of your own to build.
• Automation platform provisioning connects Webflow forms and orders to Entra ID, where Authenticator enrollment is managed.
• The Webflow and Microsoft Graph APIs give full control over sign-in flows and enrollment data, at the cost of real server-side development.

The first two protect people on your team. The last three protect people on your site.

Use Microsoft Authenticator for your Webflow account 2FA

This is the fastest win on the page, and it costs nothing. Webflow's two-factor authentication accepts any app that generates standard OATH TOTP codes, and Microsoft Authenticator generates exactly those, so there is no integration to wire up and no plan to upgrade.

To turn it on:

1. Open Account settings > Security from the account dropdown in the navbar, then click Enable two-factor authentication.
2. Scan the QR code with Microsoft Authenticator, which adds a Webflow entry to the app.
3. Save the backup codes Webflow shows you. They appear once, and each one works a single time.
4. Enter the current code from the app and confirm it.

Webflow then asks for a code from the app at every login. Be clear-eyed about what this buys: it stops a stolen Webflow password from turning into a defaced published site, and it does nothing for the people who log in to the site you shipped. Those two problems never share a solution.

Enforce Authenticator MFA for Workspace logins with Entra ID SSO

Workspace Single Sign-On lets IT admins put Microsoft Entra ID in front of every team login to Webflow, which means any Conditional Access policy attached to Entra ID applies. SSO is available only on Enterprise Workspace plans, and Webflow supports OAuth and SAML connections. Entra ID supports SAML 2.0, so it qualifies as the identity provider. Microsoft's own recommended way to enforce Authenticator MFA is a Conditional Access policy.

Once SSO enforcement is set to required, these are the Entra ID controls worth documenting in your own runbook:

• Push approval with number matching: Require an Authenticator approval rather than a password alone before anyone opens Webflow.
• Device and location conditions: Scope the policy so publishing access is granted only from managed devices or approved networks.
• Automated joiner and leaver handling: Use optional SCIM provisioning to grant and revoke Workspace access from Entra ID.
• Audit evidence: Keep Entra sign-in logs as the record of who authenticated into Webflow and how, ready for a compliance review.

Two limits are worth knowing before you promise this to a security team. Workspace SSO protects team logins only, never visitors to your published site, and SCIM assigns access rather than roles, so Webflow permissions are still set inside Webflow.

Embed an identity provider that works with Microsoft Authenticator

This is the route for site visitors, and since User Accounts was withdrawn it is the only one that does not involve writing a backend. Auth0's OTP documentation names Microsoft Authenticator explicitly as an enrollable authenticator app. Outseta and Memberstack support TOTP generically, and Microsoft Authenticator emits standard OATH TOTP codes. Each of them loads from a script tag, which goes in your site's head or into a Code Embed element, and both placements need a paid Site plan or a paid Workspace plan.

Set up Auth0 OTP MFA

Auth0's single-page app SDK handles sign-in from a static Webflow page. Enabling OTP as the MFA factor takes no code, while wiring the login and logout buttons does take JavaScript.

To set up Auth0 with Authenticator OTP:

1. Load the Auth0 SPA SDK by adding <script src="https://cdn.auth0.com/js/auth0-spa-js/2.24/auth0-spa-js.production.js"></script> to your site's head in Site settings > Custom code.
2. Add your published site URL to Allowed Callback URLs, Allowed Logout URLs, and Allowed Web Origins in the Auth0 Dashboard.
3. Enable OTP under Dashboard > Security > Multi-factor Auth, following the enable MFA guide.
4. Wire your login and logout buttons to the SDK with custom JavaScript.

Auth0's OTP enrollment prompt walks users through adding the app at their next sign-in. Auth0 can also federate to Microsoft Entra ID through an enterprise connection, so work accounts authenticate against Entra ID and your Conditional Access policies apply to them. Treat client-side gating as a first filter only, because whatever the browser decides, the browser can be made to decide differently. Token verification has to happen server-side, in Webflow Cloud or a serverless function.

Use Outseta or Memberstack for member login with TOTP

These two products land in different places on member 2FA, so check which one you already run before planning the work. Outseta exposes two-factor authentication to your site's members and can force enrollment on all of them. Memberstack's native 2FA feature covers Memberstack dashboard and team accounts rather than your site's members, so member-facing TOTP there needs a custom script from its MemberScripts library. Neither product's docs name Microsoft Authenticator, and neither needs to, because the app generates the same TOTP codes for third-party accounts.

To set up Outseta:

1. In the Outseta dashboard, follow the Webflow integration guide to copy the Quick Start head script from Auth > Embeds.
2. Paste it into the head section under Site settings > Custom code.
3. Wire your buttons and links to Outseta's embed URLs.
4. Turn on two-factor authentication under Auth, and select the option to require it if you want every member enrolled.

Memberstack works through data attributes instead, and it carries one Webflow-specific catch worth flagging early. Memberstack lists Microsoft as an unsupported auth provider in Webflow, because Microsoft social login wants a verification file at the domain root that a Webflow-hosted domain cannot serve. That limit applies to Microsoft social sign-in, not to TOTP, so Microsoft Authenticator as a second factor is unaffected.

Provision Microsoft Entra ID users from Webflow with Zapier, Make, or n8n

Authenticator enrollment lives in Microsoft Entra ID, so automation platforms connect to Entra ID rather than to the Authenticator app, which has no standalone API of its own. n8n publishes a Webflow pairing page for the combination, Zapier lists an Entra ID connector, and Make publishes Entra ID modules that sit behind Make's own Enterprise plan, which is easy to miss when costing a project.

The useful workflows pair a Webflow trigger with an Entra ID action:

• Provision portal access from a form: Send New Form Submission in Webflow to Create User in Entra ID so a signup request becomes a real directory account.
• Grant group access after a purchase: Send New Order in Webflow to Add User to Group in Entra ID and let group membership drive what the buyer can reach.
• Keep a staff directory in sync: When a new user appears in Entra ID, create an item in the Webflow CMS so the published directory matches the org chart.
• Deprovision on the way out: When a directory account is disabled, unpublish or archive the matching CMS item rather than leaving a stale profile live.

Automation creates the account and nothing more: new users still register the app themselves through Microsoft's security info flow at their first sign-in.

Build with the Webflow and Microsoft Graph APIs

Build against the Microsoft identity platform and Webflow's Data API when you need control over sign-in, MFA enforcement, and user data that a hosted embed will not give you. This path needs server-side development, because published Webflow pages cannot securely redeem or validate tokens and custom code does not run server-side languages.

Four APIs carry the work between them:

• Microsoft identity platform OIDC endpoints: The OIDC protocol reference covers sign-in, token issuance, and logout.
• Microsoft Graph authentication methods: The Authenticator method resource lists, reads, and deletes Authenticator registrations for a user.
• Webflow Data API: Webflow's REST API handles CMS collection items and site publishing from your backend.
• Webflow webhooks: Webhook events push form submissions and CMS item changes to you instead of making you poll for them.

In practice those four combine into one of the two patterns below.

Gate Webflow pages with the Entra authorization code flow

This pattern redirects visitors to Microsoft's hosted sign-in, where Conditional Access enforces Authenticator MFA, then validates the returned tokens in middleware before serving gated content. The full exchange is documented in the authorization code flow reference.

To implement it:

1. Register an application in the Entra admin center under Entra ID > App registrations > New registration and record the Application (client) ID. For single-page apps, set the redirect URI type to spa so it supports PKCE and CORS.
2. Send users to GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize with client_id, response_type=code, redirect_uri, a scope containing openid, plus state, nonce, code_challenge, and code_challenge_method=S256.
3. Redeem the code at POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token with grant_type=authorization_code and the code_verifier.
4. Validate token signatures against the JWKS endpoint at https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys.
5. Confirm which factor was used through the amr claim. Authenticator push produces rsa, and adds mfa once it has satisfied MFA alongside another factor, while passwordless phone sign-in produces swk and mfa.

Enforcement itself belongs to Conditional Access rather than to your code, which is the part teams most often try to reimplement by hand. When a policy blocks a silent request the app receives error=interaction_required and has to retry interactively. Webflow Cloud middleware is again a first filter: verify the token inside the Route Handler that serves the protected content.

Manage Authenticator enrollment and sync users to the CMS

Microsoft Graph gives you read and delete operations on Authenticator registrations plus a Temporary Access Pass for onboarding, and no way to register the app on someone's behalf. No POST endpoint exists for that, so users always self-register at https://aka.ms/mysecurityinfo.

An enrollment-aware backend makes these calls in order:

1. Poll registrations with GET https://graph.microsoft.com/v1.0/users/{id|upn}/authentication/microsoftAuthenticatorMethods using the UserAuthenticationMethod.Read.All permission. Polling is the only option, because authentication method paths are not subscribable in Graph change notifications.
2. Onboard new users with a Temporary Access Pass via POST /v1.0/users/{id|upn}/authentication/temporaryAccessPassMethods, then send them to security info enrollment.
3. Write the resulting user records into Webflow with POST https://api.webflow.com/v2/collections/{collection_id}/items using the CMS:write scope.

Three details bite people here. A TAP code is returned only at creation and never again, only one pass exists per user at a time, and the user has to be in scope of the TAP policy before any of it works.

What you can build with the Microsoft Authenticator Webflow integration

Integrating Microsoft Authenticator with Webflow puts MFA-backed identity in front of your team and your content without you hosting an authentication system.

• Gated client portal with MFA: An agency builds a client document portal on Webflow with Auth0 handling login, clients confirm each sign-in with an Authenticator code, and middleware validates tokens before serving pages.
• MFA-protected Workspace access: An IT admin on an Enterprise plan routes all Webflow logins through Entra ID SSO, so every designer and editor approves an Authenticator push with number matching before opening a site.
• Staff directory synced from Entra ID: A new Entra ID user triggers an automation that creates a CMS item, and the published site renders the directory with a Collection List.
• Compliance-ready partner portal: A financial services team gates partner content behind Entra Conditional Access, Authenticator satisfies the possession factor the FTC Safeguards Rule expects, and Entra sign-in logs supply the audit evidence.

For a working reference build of the visitor-login half, follow our Auth0 authentication walkthrough. Once the access model is settled, connect the Webflow MCP server so you can review site permissions and the activity log from the AI client you already work in.