Multi-factor authentication (MFA) with Microsoft Authenticator: what it is and how to set it up

Multi-factor authentication (MFA) adds a second check when you sign in, usually a quick approval on your phone. Even if someone steals your password, they can't get into your account without that second step.

How it works

When you sign in to Microsoft 365, you enter your password as usual. Microsoft then sends a notification to the Microsoft Authenticator app on your phone. The sign-in screen shows a two-digit number, and you type that number into the app to approve. This is called number matching, and it makes sure the person approving is the person signing in.

Before you start

• Have your smartphone and your computer side by side.
• Install Microsoft Authenticator from the App Store (iPhone) or Google Play (Android). Make sure the publisher is Microsoft Corporation.
• Know your Microsoft 365 email address and password.

Set up Microsoft Authenticator

1. On your computer, go to aka.ms/mfasetup and sign in with your work email and password. If you're prompted with More information required, click Next and follow the wizard; the steps are the same.
2. If you land on the Security info page instead, click Add sign-in method and choose Authenticator app. You can also reach this page at mysignins.microsoft.com/security-info.
3. Click Next until a QR code appears on the screen.
4. On your phone, open Microsoft Authenticator. Allow notifications when asked.
5. Tap the + button (or Add account), choose Work or school account, then Scan QR code.
6. Point your phone's camera at the QR code on your computer screen. The account will appear in the app.
7. Back on the computer, click Next. Microsoft will send a test notification. Type the number shown on your computer into the app and tap Yes.
8. When you see that the notification was approved, click Next and then Done.

Golden rule: never approve a request you didn't start

If your phone shows an Authenticator request and you are not signing in at that moment, someone else probably has your password and is trying to get in.

1. Tap No, it's not me (or Deny). Never approve it "just to make it go away".
2. Change your Microsoft 365 password as soon as possible.
3. Let us know by opening a ticket so we can check your account.

Getting a new phone

Plan ahead before you trade in, reset or give away your old phone:

1. Install Microsoft Authenticator on the new phone.
2. While you still have the old phone, sign in at mysignins.microsoft.com/security-info, click Add sign-in method and register the Authenticator app on the new phone, following the steps above.
3. Test a sign-in with the new phone.
4. Then remove the old phone's entry from the Security info page by clicking Delete next to it.

The app's backup feature can restore some accounts, but work accounts often need to be signed in again on the new device, so don't rely on it alone. If your phone was lost, stolen or already reset, contact us so we can help you regain access safely.