Microsoft Two-Factor Authentication: How to Turn It On

Turn on Microsoft two-step verification at account.microsoft.com › Security › Advanced security options. Use the Authenticator app or a passkey.

Steps

1. Sign in at account.microsoft.com.
2. Open Security › Advanced security options.
3. Under two-step verification, choose Turn on.
4. Follow the setup and save the recovery code shown.

Methods you can use

App passwords

Some older apps and devices cannot handle two-step verification. Microsoft offers app passwords for these: you create one in Advanced security options and use it in place of your normal password on that app.

Recovery code

Microsoft gives you a recovery code when you set up two-step verification. Store it in a password manager or on paper. It lets you in if you lose your phone and other methods.

Passwordless sign-in

Microsoft lets personal accounts remove the password altogether and sign in with the Authenticator app, a passkey or a security key. This stops password attacks, but make sure you have at least two ways in before switching.

Work and school accounts

Accounts from an employer or school are set up by their IT team, which controls the methods allowed. Ask them if you change phones.

Codes not arriving? See Microsoft code not sent.

Turning it off

You can turn off two-step verification in the same Advanced security options page, but doing so makes your account easier to take over, especially if your password is reused elsewhere. A better fix for frequent prompts is to tick the option to stay signed in on devices you trust.

New phone checklist

1. Install Microsoft Authenticator on the new phone.
2. Turn on cloud backup in the app on the old phone first, then restore it on the new one.
3. Sign in and approve a test request.
4. Remove the old phone from your security info.

FAQ

How do I turn on Microsoft two-step verification?

account.microsoft.com › Security › Advanced security options.

What if I lose my phone?

Use your recovery code or another method.

Can I sign in to Microsoft without a password?

Yes, with the Authenticator app, a passkey or a security key.

Related: Microsoft code not sent · recover a Microsoft account · passkeys.