MFA adds a second verification on top of your password. Setup takes 5-10 minutes per service.

1. Choose your method

Most common options:

  • Authenticator app (recommended) — Microsoft Authenticator, Google Authenticator, Authy, Duo
  • Hardware key (most secure) — YubiKey, FeitianFIDO2 keys
  • SMS / phone call (least secure but better than nothing)

2. Install an authenticator app

For Microsoft 365 / corporate accounts, install Microsoft Authenticator:

  • iOS App Store / Google Play
  • Free, no account required to start
  • Sign in to it with your Microsoft account to enable cloud backup

3. Enroll in MFA for Microsoft 365

If your org doesn't already require it:

  1. Sign in to aka.ms/mfasetup with your work account
  2. Add the Microsoft Authenticator app as a sign-in method
  3. The site shows a QR code; in the app, tap + → Work or school account → Scan QR code
  4. Scan it
  5. Confirm by approving a test push

You're now enrolled.

4. Use the app for sign-in

Next time you sign in:

  • Enter password as usual
  • Microsoft shows "Approve sign-in" — you'll see a number
  • Open the app — it shows the same number; tap to approve

The numbered approval prevents accidental approval of attacker requests.

5. Set up a hardware key

If you have a YubiKey or similar:

  1. Go to mysignins.microsoft.com/security-info
  2. Add sign-in method → Security Key
  3. Follow the steps to register

Hardware keys are most secure because they're physical and resistant to phishing.

6. Add multiple methods

Always add at least two:

  • Main: app push or hardware key
  • Backup: SMS to phone, or backup codes

If you only have one method and lose it, you're locked out until IT resets.

7. Generate backup codes

At mysignins.microsoft.com/security-info:

  • Click Show next to "Sign-in methods"
  • Add method → App passwords or Backup codes
  • Save the codes in a secure place (password manager, printed and locked away)

These get you in if your phone is unavailable.

8. Enable cloud backup in the authenticator

For Microsoft Authenticator:

  • Settings → Backup → enable iCloud / Microsoft account backup
  • When you get a new phone, the app restores your accounts

For Google Authenticator (which doesn't have cloud backup by default):

  • Settings → Export Accounts → use to transfer to a new phone
  • Or use Authy, which has cloud sync built in

9. Authenticator on multiple devices

It's safe to install authenticator on:

  • Your phone (primary)
  • A tablet (backup)
  • A spare phone

Each generates the same codes. More devices = more backup.

10. Specific to work account vs. personal

Microsoft Authenticator handles both:

  • Work or school account (your @company.com)
  • Personal Microsoft (Outlook.com, Hotmail)

Same app, separate entries. Don't get them mixed up — the work code won't work for personal and vice versa.

When to ticket

Raise a ticket if:

  • MFA enrollment site doesn't accept your credentials
  • You need MFA enforced on a specific application that doesn't have it
  • Specific MFA method (e.g. hardware key) is required by your role
  • You need bulk MFA setup for a new team

Include the service and what method you want enabled.