Short answer: Go to account.microsoft.com → Security → Advanced security options, find Two-step verification and turn it on. Add an authenticator app as your sign-in method, then save the 25-character recovery code Microsoft generates. While you are there, consider going passwordless — Microsoft accounts can drop the password entirely and use a passkey or app approval instead.
Why this account matters more than most
A Microsoft account is rarely just Outlook. It is usually your email, your OneDrive files, your Xbox library and Game Pass, your Office subscription, your Windows device sign-ins, and — if you have ever bought anything — a stored payment method. It is also the recovery address for other services you signed up for years ago.
Xbox accounts in particular are stolen at scale, because game libraries and Microsoft Points have resale value and because gamer tags themselves are traded. And once someone controls the account, they control the password reset path for everything that uses that email address.
Step 1: Open advanced security options
- Sign in at account.microsoft.com.
- Select Security from the top menu.
- Choose Advanced security options (sometimes shown as your security dashboard).
- Under Additional security, find Two-step verification and select Turn on.
Microsoft walks you through a short wizard. Take the time to read it rather than clicking through — the recovery code step at the end is the one that matters.
Step 2: Add an authenticator app
Under Ways to prove who you are, select Add a new way to sign in or verify, then Use an app.
You have two paths:
- Microsoft Authenticator — adds push approvals with number matching on top of standard codes, and unlocks passwordless sign-in. The best fit if you also use a work Microsoft 365 account. See Microsoft Authenticator vs Google Authenticator.
- A different authenticator app — choose the “set up a different Authenticator app” link and Microsoft shows a QR code that works with Google Authenticator, Authy, Aegis, 2FAS, or a password manager. Our roundup of the best authenticator apps covers the options.
Scan the code, or use the manual key if you are setting this up on the same device — see how to enter a setup key manually. Confirm with the six digits your app generates.
Do not screenshot the QR code. It contains the raw secret, and anyone who obtains that image can generate your codes indefinitely.
Step 3: Save the recovery code
Under Advanced security options, look for Recovery code and generate one. It is a single 25-character string, and it is your escape hatch if you lose every other verification method.
Print it, or store it in an encrypted vault you can open without your phone. Not in OneDrive — that is the account it unlocks. Our guide on where to store backup codes safely covers the reasoning, and how to back up your authenticator app covers the wider plan.
Microsoft account recovery without a code involves a form asking about past subject lines and purchase history, reviewed on a delay. It works, occasionally. Do not rely on it.
Step 4: Remove the weak methods
Your account is only as strong as the weakest sign-in method left enabled. Check the list under Ways to prove who you are and remove:
- Old phone numbers — SMS is vulnerable to SIM swap attacks, and an obsolete number may now belong to a stranger.
- Alternate email addresses you no longer control — an address at a former employer is a live hole.
Keep one reachable backup method beyond the app, but choose it deliberately. The comparison is in SMS 2FA vs authenticator apps.
Step 5: Consider going passwordless
Microsoft is one of the few consumer providers that lets you delete the password entirely. Under Advanced security options → Additional security, turn on Passwordless account.
Sign-in then uses Microsoft Authenticator approval, a passkey, Windows Hello, or a security key. There is no password to phish, reuse, or leak in a breach — which removes the first half of nearly every account takeover.
Before you do it, make sure you have at least two working methods registered and your recovery code saved. Removing the password with only one enrolled device is how people lock themselves out. Background reading: passkeys vs 2FA and what phishing-resistant MFA is.
Step 6: Add a security key and check app passwords
Microsoft supports FIDO2 security keys for sign-in. If you administer anything, hold significant Xbox value, or simply want the strongest option, register two keys — see what a hardware security key is.
Also check App passwords in advanced security options. These bypass two-step verification entirely and were issued to older mail clients and devices. Revoke any you do not actively need.
Finally, review Sign-in activity for logins you do not recognise, and confirm the security contact email on the account is one you still control.
Frequently asked questions
Do I have to use Microsoft Authenticator?
No. Microsoft supports any standard TOTP app through the “different authenticator app” option. Its own app adds push approvals and passwordless sign-in, which is convenient but optional. See how TOTP codes work.
Does this protect my Xbox and Office too?
Yes. They are the same account, so two-step verification covers all of them. Xbox consoles remain signed in, but new sign-ins require verification.
Why does Microsoft keep asking for codes on the same device?
Tick “I sign in frequently on this device” when prompted, and make sure your browser is not clearing cookies on exit. On a shared computer, leave it unticked deliberately.
Why is my code rejected?
Usually clock drift between your phone and Microsoft’s servers. Turn on automatic network time. Our guide to 2FA codes being rejected covers the rest.
What if I lose my phone and my recovery code?
You will need Microsoft’s account recovery form, which asks detailed questions about your account history and is reviewed manually with a delay. Our guide on recovering accounts after losing your 2FA phone covers what to prepare.
Is a passwordless Microsoft account actually safer?
Yes, for most people. The password is the most commonly stolen credential, and removing it eliminates phishing, credential stuffing and breach reuse in one step — provided your remaining methods are properly backed up.
The bottom line
Two minutes to enable, one minute to save the recovery code, five minutes to clear out old phone numbers and app passwords. Do all three. And if you have two verification methods working, going passwordless is the rare security upgrade that also makes daily life easier.
Testing your setup? Our free online 2FA code generator runs entirely in your browser.