The exact Microsoft 365 MFA setup process depends on your organizationโs Microsoft Entra ID security policies. When MFA is required, Microsoft prompts you to register one or more approved verification methods during sign-in.
*Microsoft maintains current instructions for setting up multifactor authentication for a Microsoft 365 account.
The Sign-in Page
Go to your O365 account from a web browser to https://office.com
Click the Sign In button and you'll be prompted for you O365 credentials, which are the same as your Windows credentials and email address, Type your email address and Click Next
*Note - If you have used your corporate email address to create a Personal account, you'll first be prompted for either Work or school account or Personal account as below. Choose Work or school account
Type your password and Click Next
*Note - This is the password for your Office 365 account, which should be the same password you use to login to your work or school computer
You'll get a notification requiring more information. This is the prompt to activate your MFA methods. Click Next
Methods of MFA
At this point you'll be able to select the authentication method you will use to verify your identity. The primary authentication method and default is Microsoft Authenticator.
Then, you can register a backup method if your organization requires or permits one. Examples are shown for Authentication Phone and Office Phone following the Microsoft Authenticator option
Microsoft Authenticator
This method requires that you download the Microsoft Authenticator app from the application store of your device. You can choose.
- Receive notifications for verification. This will send a push notification on the device to deny or approve.
- Use verification code. This will show a code in the app that you can enter for any prompts.
If choosing this method, select how you would prefer for the app to notify you, then click Set upโฆ
โฆand then follow the steps to install the Microsoft Authenticator app, add the account, and either scan the QR code or enter the code into the app, then click Next
Then, click Next again
You'll receive a prompt from the application on your mobile device. Either approve the request on your device, or open the application, select the account, then enter the code and click Verify.
Authentication Phone
This method allows you to use your mobile phone and you can choose to either get a text message or phone call.
If choosing this method, type your mobile number, then click Next
You'll either receive an SMS message with a code, or you'll receive a call with a code. Enter the code in the box, then click Verify
Office Phone
This method allows you to use your office or desk phone.
If choosing this method, type your office number and extension, if applicable, and click Next
You'll then get a phone call at the number you specify. Follow the voice prompts to verify
Most current Microsoft 365 applications support modern authentication and do not require app passwords. Some legacy applications or devices may still require an app password if your organization permits them. If you encounter this situation, contact your IT administrator before configuring one.
What Happens Next After Activation
You will now return to your online Office 365 account home page.
Your account is now enabled for MFA and there's nothing more to do. If you open the Outlook application, the Outlook Web Application, try to activate a mobile device with your services, or any other login to Office 365 services, you'll receive a prompt with the authentication method you setup as above.
Follow the steps to verify your sign in and you're sign in to your services is active.
How often you are prompted for MFA depends on your organizationโs Microsoft Entra ID and Conditional Access policies. You may be prompted when signing in from a new device, using certain applications, connecting from a different location, or when other security conditions require additional verification.
If you have trouble with any future verifications, ask your organization administrator for assistance in either retrieving your settings, or resetting your settings.
MFA is one important layer of account protection, but it works best as part of a broader cybersecurity strategy. Learn more about our Managed Security Services for protecting Microsoft 365 accounts, endpoints, networks, and business data.
For manufacturers preparing for cyber insurance renewal, our Manufacturing Cyber Insurance Guide explains how MFA fits into the broader set of controls insurers commonly evaluate.
