On This Page
To set up multi-factor authentication (MFA) on a Microsoft 365 work account, install the Microsoft Authenticator app on your phone, go to Microsoft’s MFA setup page (aka.ms/mfasetup), sign in with your work or school account and add the app as a sign-in method. Then add a backup method so you can still sign in if you lose your phone.
- Install Microsoft Authenticator on your phone.
- Go to aka.ms/mfasetup and sign in with your work or school account.
- Click Add sign-in method, choose Authenticator app and follow the prompts.
- Add a second sign-in method as a backup.
Why MFA Matters
A password on its own is a single lock. If someone steals or guesses it, they can sign in as you. MFA adds a second check, usually an approval in an app on your phone, so a password alone isn’t enough to get into your email, files and Teams.
How to Set Up MFA in Microsoft 365
You only need your phone and your work or school sign-in details.
1. Install Microsoft Authenticator
Android: scan the QR code below or open the Microsoft Authenticator download page on your phone.
iPhone: scan the QR code below or open the Microsoft Authenticator download page on your phone.
2. Add the App to Your Microsoft 365 Account
- Go to Microsoft’s MFA setup page at aka.ms/mfasetup.
- Sign in with your Microsoft 365 work or school account.
- Click Add sign-in method.
- Choose Authenticator app and click Add.
- Follow the on-screen instructions to add your account to the app.
3. Add a Backup Sign-in Method
If you lose your phone, you can be locked out of your account. Add a second sign-in method now, while you still have access to the first.
Microsoft is retiring SMS text and voice-call authentication on 1 February 2027, so a second phone number is no longer a good long-term backup. Choose something that will still work after that date, such as:
- A passkey on a second trusted device
- Windows Hello on your work computer
- A physical FIDO2 security key
- An alternate email address, if your organisation allows it
If a phone number is your current backup, swap it out before the deadline. Our guide to Microsoft retiring SMS authentication covers the full timeline.
4. Sign In With MFA
Next time you sign in, you’ll enter your password as usual, then Microsoft will ask you to approve the sign-in in the Authenticator app. It’s one extra step, and it stops a stolen password from being enough on its own.
Want more security across your business? Ask us about Microsoft 365 Business Premium.
What About Passkeys?
Since 1 September 2026, Microsoft has made passkeys the default sign-in experience for Microsoft 365. If your organisation has switched them on, you may be asked to set one up next time you sign in.
A passkey does the same job as the code from your authenticator app, without the code. You confirm it’s you with your fingerprint, face or device PIN, and the credential stays on your device. That makes it much harder to phish than a six-digit code someone could trick you into typing into a fake sign-in page.
If you’ve already set up Microsoft Authenticator, you’re in a good spot: the same app can hold a passkey. If you look after MFA for a whole team, read what Microsoft’s SMS retirement means for your business for the dates and steps.
Why Businesses Are Making MFA Standard
In finance, healthcare and parts of retail, government guidance and industry standards are pushing businesses towards MFA. Without it, a single stolen password can be enough to get into email and files, and a breach can bring compliance trouble and damage to your reputation.
Attacks are also changing quickly. MFA adds a second barrier that stops many attacks that rely on a stolen password, and slows others down so you have time to respond. For most teams it’s one of the simplest security improvements to make. Pair it with our cybersecurity solutions for wider protection.
Common Questions
What is aka.ms/mfasetup?
It’s Microsoft’s short link to the security info page for your work or school account. That’s where you add and manage sign-in methods, such as the Microsoft Authenticator app or a passkey.
Can I still use SMS codes for MFA?
For now, but Microsoft is retiring SMS text and voice-call authentication on 1 February 2027. Use the Authenticator app or a passkey instead, and swap out any phone number you rely on as a backup.
What if I lose my phone?
Sign in with your backup method, then remove the lost phone at aka.ms/mfasetup. If you don’t have a backup method, your IT administrator will need to reset your sign-in methods before you can set up MFA again.
Can you set up MFA for our whole team?
Yes. As part of our managed IT and Microsoft 365 management, our team can help you plan and roll out MFA for every user, including backup methods and passkeys.
Talk to Our Team
Databox Solutions manages Microsoft 365 and cybersecurity for Australian businesses from our offices in Brisbane and Melbourne. See our managed IT services and cybersecurity solutions, or call 1300 603 404.
