Azure Two-Factor Authentication (MFA): Setup Guide

Azure sign-ins use Microsoft Entra multifactor authentication. Register a method at your Security info page, ideally the Microsoft Authenticator app.

Register your methods

1. Sign in at mysignins.microsoft.com with your work or school account.
2. Open Security info.
3. Choose Add sign-in method.
4. Pick Microsoft Authenticator and follow the steps to scan the QR code.
5. Add a second method as a backup.

Methods compared

Required for Azure portal

Microsoft now requires multifactor authentication for signing in to the Azure portal and other admin tools. If you are suddenly asked to set it up, this is likely why. Your organisation may also use Conditional Access rules that ask for MFA in more situations.

For administrators

• Security defaults turn on MFA for all users in small tenants.
• Conditional Access gives finer control in paid plans.
• Keep at least one emergency access account excluded and protected separately.
• Service accounts and scripts should use managed identities or workload identities, not user MFA.

New phone

Add the Authenticator on the new phone in Security info before wiping the old one. If the old phone is gone, ask your IT admin to require re-registration of MFA for your account.

Prompts you did not expect

An approval request you did not start means someone may have your password. Deny it, change your password and tell your IT team. Number matching, where you type the number shown on screen, helps stop accidental approvals.

Personal Microsoft accounts work differently; see Microsoft two-step verification.

Personal Azure subscriptions

If you created an Azure subscription with a personal Microsoft account, MFA still applies to portal sign-ins. Set up the Authenticator app in your Microsoft account security settings, and add a recovery method so you are not locked out of billing and resources.

Command line and automation

Azure CLI and PowerShell sign-ins also go through MFA for user accounts. For scheduled scripts and pipelines, use a service principal or managed identity with limited permissions instead of a person's account.

FAQ

How do I set up Azure MFA?

Add methods at mysignins.microsoft.com › Security info.

Is MFA required for the Azure portal?

Yes, Microsoft now requires it.

What if I lost my Authenticator phone?

Ask your IT admin to reset your MFA registration.

Related: Microsoft two-step verification · passkeys · lost authenticator phone.