Why two-factor authentication matters
Two-factor authentication (2FA), also called multi-factor authentication (MFA), requires you to prove who you are in two different ways when you sign in. Think of a safe-deposit box that requires both a key and a code: if someone steals the key, they still can't get in.
The three factors
| Factor | Example |
|---|---|
| Something you know | Password, PIN |
| Something you have | Phone with an Authenticator app, a code by SMS, a physical security key |
| Something you are | Fingerprint, face recognition |
Two-factor authentication usually combines your password with your phone.
A password alone isn't enough
Passwords can be stolen through phishing, leaked from services that get hacked, or guessed by automated attacks. If you use the same password in several places, every account is lost when one of them leaks. With two-factor authentication, the attacker is stopped regardless: they don't have your phone and can't approve the sign-in. Microsoft estimates that two-factor authentication stops more than 99.9 percent of automated account attacks.
Ways to verify
- Authenticator app is the most secure and most convenient. The app generates a code or sends you an approval request. See Set up Microsoft Authenticator.
- SMS code is easy to set up, but slightly weaker. In rare cases, SMS messages can be intercepted.
- Physical security key via USB or NFC, for example a YubiKey. Very secure, mostly used by administrators and managers. We can supply these on request.
Common questions
- Will signing in become a hassle? Hardly. Most people experience it as one extra tap in the app, and the device remembers the approval for several weeks.
- What if I lose my phone? Set up a backup method, for example SMS. See Get MFA back after switching phones.
- Does it only apply to Microsoft 365? No. Turn on two-factor authentication wherever it's offered: online banking, email, social media and cloud storage.