Set up MFA

Who this is for: anyone setting up multi-factor authentication on a work account for the first time, or moving it to a new phone.

The short answer

Install the Microsoft Authenticator app on your phone, then go to aka.ms/mfasetup on a computer and follow the prompts. The app is the method to choose. Text-message codes work, but they're the weakest option available to you.

Why the app instead of text messages

Text codes can be intercepted by an attacker who convinces your mobile carrier to move your number to their SIM — a "SIM swap." It's not common, but it happens, and it's the one form of MFA that can be defeated without touching your phone. The Authenticator app is tied to the physical device and can also show you where a sign-in request is coming from, which makes a fraudulent prompt obvious.

Set it up

1. On your phone, install Microsoft Authenticator from the App Store or Google Play. Check the publisher is Microsoft Corporation — there are imitations.
2. On a computer, open aka.ms/mfasetup and sign in with your work email.
3. Choose Add sign-in method → Authenticator app.
4. A QR code appears on the computer screen. In the phone app, tap +, choose Work or school account, then Scan QR code.
5. The site sends a test prompt. Approve it on your phone and enter the two-digit number shown on screen.
6. Add a phone number as a backup method as well. You want a second way in if your phone breaks.

What sign-in looks like afterward

You'll enter your password as usual, then see a two-digit number on screen. Your phone shows a notification; open it and type that number. This "number matching" step exists so you can't approve a prompt by reflex — if a notification appears when you weren't signing in to anything, deny it and change your password.

Getting a new phone

Do this before you wipe or trade in the old one.

1. On the old phone, open Authenticator, go to Settings → Backup and turn on cloud backup (iCloud on iPhone, a Microsoft personal account on Android).
2. On the new phone, install Authenticator, choose Begin recovery, and sign in with the same backup account.
3. Work and school accounts require one extra verification each after recovery. Have the old phone or your backup phone number handy.

If the old phone is already gone, an admin has to clear your MFA registration so you can start over.

Common problems

• Prompts never arrive. Check that notifications are enabled for Authenticator, and that your phone isn't in a focus or do-not-disturb mode. You can also open the app manually and use the six-digit code instead.
• "You've reached the limit of verification attempts." Wait about 15 minutes and try again.
• You get prompts you didn't trigger. Someone has your password. Deny the prompt, change your password immediately, and tell us.