Overview
Multi-factor authentication (MFA) means a stolen password on its own isn't enough to get into your account. It's the single most effective thing you can do to protect a Microsoft 365 mailbox.
This guide sets up the Microsoft Authenticator app as your main method and a phone number as backup, which takes about ten minutes.
Before you begin
- Your work email address and current password.
- Your smartphone, with the Microsoft Authenticator app installed from the App Store or Google Play.
- A computer — the setup is much easier with the QR code on screen and the phone in hand.
Set up at least two methods.
One app plus one phone number means a lost or replaced phone doesn't lock you out of your account.
Step-by-step
Step 1 — Open your security info page
On the computer, sign in at:
https://mysignins.microsoft.com/security-infoStep 2 — Add the Authenticator app
Choose Add sign-in method → Microsoft Authenticator → Add. A QR code appears — leave it on screen.
Step 3 — Scan the code on your phone
In the Authenticator app, tap + → Work or school account → Scan a QR code, and point the camera at the screen. Allow notifications when prompted.
Step 4 — Approve the test prompt
The website shows a two-digit number. Enter that number in the app to confirm the pairing.
Step 5 — Add a phone number as backup
Choose Add sign-in method → Phone, enter your mobile number, and verify the code you receive by text.
Use the app for day-to-day sign-in, not text messages.
SMS codes can be intercepted through SIM-swap attacks. Keep the phone number purely as a fallback.
Step 6 — Set the app as your default
Next to Default sign-in method, click Change and choose Microsoft Authenticator – notification.
Step 7 — Test it and re-sign-in on your devices
Sign out of Outlook on the web and sign back in. Expect a one-time prompt on Outlook desktop, phone mail apps and Teams as they re-authenticate — approve each one.
Which method to use
| Method | Security | Convenience | Use as |
|---|---|---|---|
| Authenticator app (number matching) | Strong | One tap | Primary |
| Authenticator one-time code | Strong | Type six digits | Works without signal |
| Text message code | Weaker — SIM-swap risk | Easy | Backup only |
| Phone call | Weaker | Easy | Backup only |
| Hardware security key | Strongest | Carry a key | High-risk accounts |
Expected result
Signing in from a new device shows a two-digit number on screen and a matching prompt on your phone. Familiar devices ask far less often.
Troubleshooting
Still stuck?
If you'd rather not work through this yourself, CYBER904 can take it from here. Reach the team directly during business hours and we'll get it sorted.