How to Set Up Multi-Factor Authentication (MFA) in Microsoft 365

If you have ever locked your front door and also set the house alarm, you already understand multi-factor authentication.

This guide walks you through how to set up multi factor authentication (MFA) for your Microsoft 365 account using Microsoft Authenticator, Microsoft’s recommended verification method. No technical background is required.

What Is Microsoft Multi-Factor Authentication (MFA)?

Think of MFA like a bank vault that needs two different keys turned by two different people at the same time. One key alone does not open anything.

With MFA, signing into Microsoft 365 requires two or more proofs of identity, usually from different categories:

• Something you know: Your password
• Something you have: Your phone with the Microsoft Authenticator app installed
• Something you are: A fingerprint or face scan used to unlock the app itself

Even if someone steals your password, they still cannot access your Microsoft 365 account without the second factor, which is the approval sitting on your phone.

Why Microsoft Recommends Multi-Factor Authentication

Passwords used to be the whole lock. Today, they are only one part of it because:

• Data breaches are constant: Billions of passwords have leaked online over the years and are traded on the dark web.
• People reuse passwords: One leaked password can often unlock multiple accounts, including work email.
• Phishing is more convincing than ever: Fake Microsoft 365 login pages can trick even careful users into entering their passwords.
• Automated bots can guess weak passwords quickly: A password alone may not provide enough protection against automated attacks.

This is why Microsoft strongly recommends MFA for every account. In many organisations, it is now a mandatory step for signing in.

Before you begin, make sure you have:

• Access to your Microsoft 365 account
• A smartphone
• A stable internet connection
• The Microsoft Authenticator app installed on your phone

Step 1: Go to Your Security Info Page

On your computer, sign in to your Microsoft 365 account, then use either of these options:

• Go directly to mysignins.microsoft.com/security-info
• Click your profile photo in the top-right corner, select View account, then open Security info

Step 2: Add a Sign-In Method

• On the Security info page, select + Add sign-in method or Update info, depending on what appears on your screen.
• From the dropdown menu, choose Authenticator app.
• Select Add.

Step 3: Download the Microsoft Authenticator App

• On your phone, open the App Store on iPhone or Google Play on Android.
• Search for Microsoft Authenticator and install it.
• Microsoft’s setup screen may also provide a direct download link or QR code you can scan to find the app.

Step 4: Add Your Account in the App

• Open the Microsoft Authenticator app on your phone.
• Tap Add account or the + icon.
• Select Work or school account.

Step 5: Connect the App to Your Microsoft 365 Account

• On your phone, choose Scan QR code.
• A QR code will appear on your computer screen. Hold your phone up and scan it using the Authenticator app.
• Select Next on your computer after the code has been scanned.

Step 6: Approve the Test Sign-In

• Microsoft 365 will send a test notification to your phone.
• Open the notification and tap Approve.
• Your computer screen will display a confirmation message after the test succeeds.

Step 7: Set the Authenticator App as Your Default

• Return to the Security info page.
• Your account should now show the Authenticator app as a connected sign-in method.
• To make it your default option, select Change.
• Choose Microsoft Authenticator – notification, then select Confirm.

Step 8: Add a Backup Method

Adding a backup method helps ensure you can still access your account if the Authenticator app is unavailable.

• On the Security info page, select Add sign-in method again.
• Choose Phone.
• Register a mobile number you can reliably access.

You are done. From now on, signing into Microsoft 365 will prompt you to approve the login on your phone in addition to entering your password.

Critical Best Practices and Common Pitfalls

What If You Are Prompted to Register MFA at Sign-In?

If your organisation requires MFA, you may see a More information required prompt the next time you sign in.

You may have a limited window to complete registration before access is restricted. Select Next and follow the same Microsoft Authenticator setup process outlined above.

Register a Phone Number Before Relying Solely on the App

Microsoft recommends registering a phone number in addition to the Authenticator app. If the app is your only method and you lose or replace your phone before transferring your account, you may be temporarily locked out.

What to Do If You Lose or Upgrade Your Phone

• Before switching phones: Open Microsoft Authenticator on your old phone and use its backup or restore feature to transfer your accounts before wiping the old device.
• If you did not create a backup first: Sign in using your registered backup phone number, then add the Authenticator app on your new device.
• If you have no working method: Contact your organisation’s IT administrator. They can reset your MFA registration so you can set it up again.

Other Common Pitfalls to Avoid

• Do not rely on a single authentication method. Register at least one backup option.
• Do not ignore an MFA registration prompt until the deadline.
• Do not assume a strong password is enough. MFA is an additional layer, not a replacement for good password practices.
• Never approve an unexpected MFA request. If you did not initiate the sign-in, deny it and report it to your IT team.

Frequently Asked Questions

The One Thing to Remember

If you take away just one thing, setting up the Microsoft Authenticator app for your Microsoft 365 account takes only a few minutes and dramatically reduces the chance of your account being compromised, even if your password is stolen or leaked.

If your organisation needs help securing Microsoft 365 or implementing stronger cyber security controls, learn more about Levit8’s Managed Cyber Security Services.