← All guides

How to Turn On Two-Factor Authentication for Microsoft 365

Updated October 8, 2026 · 5 min read

  • microsoft-365
  • security
  • mfa

What you will need: Your Microsoft 365 sign-in, a smartphone, and about 10 minutes. The business owner or admin will also need admin access for Part 1.

Why this matters

Passwords get guessed, reused, and leaked. If someone gets yours, they can read your email, open your files, and send messages that look like they came from you.

Two-factor authentication (also called 2FA, MFA, or "two-step verification") adds a second check when you sign in. After your password, you approve the sign-in on your phone. A stolen password alone isn't enough to get in.

Microsoft calls this multifactor authentication (MFA). It's the same idea.

Jargon check:

  • Authenticator app: A free app from Microsoft that runs on your phone and approves sign-ins.
  • Admin: The person who manages your Microsoft 365 account settings. In many small businesses, that's the owner.

Part 1: Admin turns on the requirement

Microsoft has a built-in setting called security defaults that requires everyone in your organization to set up MFA. If your Microsoft 365 account was created on or after October 22, 2019, it may already be on, and Microsoft has also been turning it on automatically for some older accounts. It only takes a minute to check.

  1. Go to entra.microsoft.com and sign in with your admin account.
  2. In the left menu, select Entra ID, then Overview, then the Properties tab.
  3. Select Manage security defaults.
  4. Set Security defaults to Enabled, then select Save.

Tell your team before you flip the switch. Each person will be asked to set up the Authenticator app the next time they sign in.

Using Conditional Access? Some businesses use a more advanced feature called Conditional Access instead (it requires a higher-tier Microsoft license). The two can't be used together: if you have Conditional Access policies, security defaults stays off and your policies handle MFA. If you're not sure which you have, ask whoever set up your Microsoft 365.

Part 2: Each person sets up the Authenticator app

You'll need both your computer and your phone for this.

  1. On your phone, open the App Store (iPhone) or Google Play Store (Android). Search for Microsoft Authenticator and install it.
  2. On your computer, go to aka.ms/mysecurityinfo and sign in with your work email and password.
  3. Select Add sign-in method, then choose Authenticator app.
  4. Select Next until a QR code appears. A QR code is the square black-and-white pattern your phone camera can scan.
  5. On your phone, open the Authenticator app, choose Add account, then choose Work or school account and scan the QR code.
  6. Back on your computer, select Next. Microsoft will send a test approval to your phone. Tap Approve. If you're shown a number on the computer, type it into the app when asked.
  7. Select Done. You're set.

From now on, when you sign in, you'll enter your password and then approve the sign-in in the app.

Part 3: Plan for a lost phone (do this today, not later)

If your phone is lost or broken, you want a way back in that doesn't depend on that phone.

  1. Go back to aka.ms/mysecurityinfo.
  2. Select Add sign-in method and see what other options your account offers. Depending on how your business is set up, that might be a phone number or a second authenticator app on another device.
  3. If no other options are offered, that's normal under security defaults, which is built around the Microsoft Authenticator app. In that case, make sure your business has two admins (see below) so someone can always reset you.

What to do if you lose your phone

Don't panic. Your account isn't automatically open to anyone. Someone would still need your password.

If you set up a backup method:

  1. Go to aka.ms/mysecurityinfo on a computer.
  2. Sign in using your backup method.
  3. Delete the old phone's entry from your list of sign-in methods.
  4. Install the Authenticator app on your new phone and repeat Part 2.

If you did not set up a backup method:

  1. Contact your Microsoft 365 admin right away.
  2. The admin goes to the Microsoft Entra admin center, then Entra ID, then Users, selects your name, opens Authentication methods, and selects Require re-register MFA. This clears your old sign-in methods.
  3. The next time you sign in, you'll set up the app on your new phone.

If you are the admin and you're locked out: Another admin can reset you using the steps above. If you're the only admin, you'll have to contact Microsoft support and prove you own the business and its domain, which can take a while. That's the best reason to set up two admin accounts before you ever need them.

Also: If your phone was stolen, change your password as soon as you can, and let your admin know.

Quick tips

  • Only approve sign-in requests you started. If a request pops up and you didn't just try to sign in, tap Deny, and let your admin know.
  • Never share the numbers or codes from the app with anyone, even someone who says they're from "IT" or "Microsoft."
  • Set up your lost-phone plan right after the app. It takes two minutes and saves a lot of trouble.

Sources