Guide

How to Set Up Two-Factor Authentication on Microsoft Account

2026-02-01 · 5 min read · Steven Adams · Last reviewed: March 2026

Your Microsoft account is the gateway to Outlook, OneDrive, Xbox, Microsoft 365, Teams, Azure, and dozens of other services. A compromised Microsoft account can expose work emails, cloud files, and even billing information. Enabling two-step verification (Microsoft's name for 2FA) takes about five minutes and significantly reduces your exposure to password-based attacks.

In This Guide

  1. How to Enable 2FA on Your Microsoft Account
  2. Microsoft 2FA Methods Explained
  3. Enabling 2FA for Microsoft 365 Business
  4. App Passwords for Legacy Apps
  5. What to Do If You Are Locked Out

How to Enable 2FA on Your Microsoft Account

  1. Go to account.microsoft.com and sign in.
  2. Click Security in the top navigation bar.
  3. Under "Advanced security options", click Get started.
  4. Under "Two-step verification", click Turn on.
  5. Follow the setup wizard. You can choose from an authenticator app, email, phone number, or security key.
  6. Microsoft will prompt you to generate an app password for any legacy applications that do not support modern authentication. Save this somewhere safe.
Use the Microsoft Authenticator app for the best experience. It supports number matching (you confirm a number shown on screen, not just tap approve), which provides extra protection against MFA fatigue attacks.

Microsoft 2FA Methods Explained

Microsoft Authenticator App

The Microsoft Authenticator app is available for iOS and Android. It supports two modes: push notifications (tap Approve on a prompt sent to your phone) and TOTP codes (a 6-digit number that refreshes every 30 seconds). Microsoft recommends push notifications with number matching enabled — this requires you to type a number displayed on your computer into the app, which prevents blind approval of attacker-triggered prompts.

Third-Party Authenticator Apps

Microsoft accounts also work with any standard TOTP app, including Google Authenticator, Authy, 1Password, and Bitwarden. To use one, choose "Use an app" during setup and select "Other" to get a QR code rather than being pushed to install the Microsoft app. This is a perfectly valid choice if you already use a different authenticator for your other accounts.

Email or Phone (SMS)

Microsoft can send verification codes to your registered email address or phone number. SMS is the least secure option due to SIM-swap risk, and email is only as secure as your email account itself. Use an authenticator app whenever possible and keep email/phone as a fallback only.

Security Keys

Hardware keys such as YubiKey are supported on Microsoft accounts via FIDO2/WebAuthn. They provide the strongest protection and are phishing-resistant. Worth considering for accounts with access to sensitive business data or Azure resources.

Enabling 2FA for Microsoft 365 Business Accounts

If your Microsoft account is a work or school account managed by an organisation, your IT administrator controls 2FA settings via Azure Active Directory (now Entra ID). The process differs from personal accounts — you typically need to visit aka.ms/mfasetup to register your verification methods, and your admin may require specific methods or enforce Conditional Access policies.

App Passwords for Legacy Apps

Older applications — some email clients, older versions of Office, or third-party tools that connect to Microsoft services — do not support modern authentication and cannot handle 2FA prompts. For these, Microsoft lets you generate app passwords: long random strings that bypass 2FA for that specific app. Go to Security → Advanced security options → App passwords to generate one. Use app passwords only when necessary and revoke them when you no longer need the application.

What to Do If You Are Locked Out

If you cannot access your 2FA method, Microsoft provides several recovery options. You can use a backup verification method (email or phone if configured), your Microsoft account recovery code (generate one in advance from Security settings), or go through the account recovery form at account.live.com/acsr. The recovery process verifies your identity through questions about your account history and recent activity.

Related Articles

Review

Google Authenticator vs Microsoft Authenticator

Read →
Guide

How to Set Up 2FA on Gmail

Read →
Security

What Are Backup Codes?

Read →

Why Microsoft Account Security Matters

A Microsoft account controls access to Windows login, Outlook email, OneDrive file storage, Microsoft 365 applications, Xbox gaming, Azure resources, and any apps where you have used "Sign in with Microsoft." For business users, a compromised Microsoft account can mean exposure of all work documents, emails, and Teams conversations. Microsoft accounts are one of the most targeted account types globally because of how many services they control.

Microsoft Authenticator: More Than Just TOTP

Microsoft offers its own authenticator app — the Microsoft Authenticator — which provides features beyond standard TOTP codes. The most notable is passwordless sign-in: instead of entering a password and then a 2FA code, you simply enter your email and then approve a push notification on your phone, with no password required. Microsoft Authenticator also supports number matching (you select the number shown on your login screen from three options in the app, preventing notification spam attacks) and additional context (the app shows the app requesting access and your approximate location before you approve).

Microsoft's Authenticator App vs Third-Party Apps

Any TOTP-compatible authenticator app works with Microsoft accounts — Google Authenticator, Authy, and 1Password all generate valid codes. However, Microsoft Authenticator unlocks additional features like passwordless login and push approval that TOTP apps cannot provide. If you are already in the Microsoft ecosystem (Windows, Outlook, Teams), Microsoft Authenticator is the logical choice. Standard TOTP works fine for basic protection if you prefer to consolidate all your 2FA in one third-party app.

What to Do If You Are Locked Out

Microsoft's account recovery process at account.live.com/acsr asks you to provide as much information as possible to verify your identity — previous passwords, email addresses, phone numbers, and details about recent activity. Microsoft cannot guarantee recovery for all accounts, particularly those with little activity history. To prevent lockout, set up multiple 2FA methods (phone number, email, and authenticator app) and generate and save your Microsoft account recovery code in Settings → Security → Advanced security options.

Frequently Asked Questions

Does Microsoft 2FA protect my Xbox account? Yes — your Xbox account is your Microsoft account. Enabling 2FA on your Microsoft account protects Xbox Live, your game library, and any credit stored in your Microsoft wallet.

Can I use a hardware security key with my Microsoft account? Yes — Microsoft accounts support FIDO2 security keys, which can be registered in Security settings. Microsoft also supports Windows Hello (facial recognition, fingerprint) as a 2FA method on supported Windows devices.

What is Microsoft's passwordless sign-in? Passwordless sign-in means the Microsoft Authenticator app IS your only factor — no password is required. Passwordless is considered more secure because passwords are the primary attack surface, and eliminating them removes phishing risk entirely.