How to Set Up Microsoft Authenticator and Backup Sign-in Methods

Why Microsoft 365 asks for another sign-in check

Multifactor authentication (MFA) adds another check when you sign in. Along with your password, you confirm it is really you using a method such as Microsoft Authenticator. This helps protect your work account if someone else gets your password.

If The IT Workshop manages your Microsoft 365, we may have directed you here as part of setting up your account. The available sign-in methods are controlled by your organisation, so you may see slightly different choices from the examples below.

Set up Microsoft Authenticator

1. On your iPhone or Android phone, install Microsoft Authenticator from Apple's App Store or Google Play. Check that the publisher is Microsoft Corporation.
2. On your computer, open the Microsoft 365 Security info page and sign in with your work email address. If you are already signed in, make sure it is your work account.
3. Select Add sign-in method, choose Microsoft Authenticator, then select Add or Next to begin.
4. If Authenticator is already installed, continue until a QR code appears on your computer. Leave that page open.
5. Open Microsoft Authenticator on your phone. Select the + button, choose Work or school account, then select Scan a QR code.
6. Use your phone to scan the QR code on your computer. If you cannot scan it, use Microsoft's Can't scan the QR image option and follow the instructions to enter the details manually.
7. Continue on your computer. Microsoft will send a test notification to Authenticator. Approve it on your phone, then finish the setup.
8. Return to the Security info page and check that Microsoft Authenticator appears in your list of methods.

During your first sign-in, Microsoft may show a Let's keep your account secure or More information required prompt. Follow the on-screen setup to add Authenticator. If the prompt asks for another method as well, complete that step too, then return to Security info to check that both methods are listed.

Keep the QR code private. It is part of linking the work account to your Authenticator app. Only scan it from the Microsoft sign-in page you opened yourself.

Important: add a backup sign-in method

While you are signed in to the Security info page:

1. Select Add sign-in method.
2. Choose another method that your organisation allows, such as a mobile phone number for text or voice verification, or Microsoft Authenticator set up on a second device.
3. Follow Microsoft's prompts to verify the method, then return to Security info and confirm it appears in the list.

Available methods depend on your organisation's security settings. A second method on the same phone may help if the Authenticator app has a temporary issue, but it will not help if that phone is lost, damaged or unavailable. Choose a method on a different device or otherwise accessible independently from your primary phone.

A method for password recovery is not necessarily a method you can use to complete an MFA check at sign-in. For example, an alternate email address may be available for resetting a password but not for approving a sign-in. Make sure your backup is listed in Security info as an available sign-in method and is permitted by your organisation.

Before you replace or reset your phone

1. While you can still use your old phone, open the Security info page and add Authenticator on your replacement phone as another sign-in method.
2. Complete Microsoft's verification and test signing in or approving a sign-in with the new phone.
3. Keep the old phone available until you have confirmed the new method works. Only then remove methods or devices you no longer use.

Restoring Authenticator or transferring your phone data does not necessarily complete registration for a Microsoft 365 work account. Microsoft may restore the account name but require you to sign in and set it up again on the new phone.

If you cannot approve a sign-in

1. On Microsoft's sign-in screen, select Sign in another way or I can't use my Microsoft Authenticator app right now, if offered.
2. Choose a different method you previously registered and can access, then follow the verification prompts.

If you have lost your phone and cannot use another registered method, you cannot bypass MFA yourself. If The IT Workshop manages your Microsoft 365, contact us so we can help with the authorised recovery process. If another provider manages your account, contact that provider.