Turning on multi-factor authentication
Updated 8 November 2026 · How-toSecurity
The single most effective step against account takeover, explained for Microsoft 365 and Google Workspace, with an authenticator app rather than text messages.
Why it matters
Nearly every account break-in we see starts with a password that was guessed, reused or typed into a fake sign-in page. Multi-factor authentication (MFA) adds a second step on a device you hold, so a stolen password alone is not enough.
Use an authenticator app
Install Microsoft Authenticator or Google Authenticator on your phone. Codes sent by text message work in a pinch but can be intercepted, so treat them as a fallback only.
Microsoft 365
- Go to mysignins.microsoft.com/security-info and sign in.
- Choose Add sign-in method, then Authenticator app.
- Scan the QR code with the app and approve the test prompt.
- Add a second method, such as your phone number, so you are not locked out if you lose the phone.
Google Workspace
- Go to myaccount.google.com/security.
- Open 2-Step Verification and follow the steps, choosing the authenticator app option.
- Save the backup codes somewhere safe.
Getting a new phone
Set up the authenticator on the new phone before wiping the old one. If the old phone is already gone, contact us and we will reset the method after confirming it is you.
If you get a prompt you did not ask for
Choose No or Deny, then tell us straight away. It usually means someone has your password and is trying to use it.
Was this helpful?