Two-factor authentication adds a second verification step when you sign in

Two-factor authentication (often called 2FA) means Outlook asks for two different proofs that you are you before letting you in. The first is your password. The second is usually a code from your phone — either a text message, an authenticator app, or a notification you approve on the spot. This stops someone who has stolen your password from getting into your account, because they would also need your phone.

Microsoft calls this feature "two-step verification" in Outlook settings, but it works the same way. You turn it on in your Microsoft account settings, not inside Outlook itself. Once it is on, every time you sign in to Outlook from a new device or browser, you will need to provide that second proof.

Key Takeaways

  • Two-factor authentication is turned on through your Microsoft account settings at account.microsoft.com, not through Outlook itself.
  • You must set up at least one verification method — a phone number for text codes, an authenticator app, or both — before you can turn on two-step verification.
  • After you turn it on, you will need to provide a second code each time you sign in from a device or browser Outlook has not seen before.
  • You can choose to trust a device for 30 days so you do not have to enter a code every single time on your main computer or phone.
  • If you lose access to your phone, you can use backup codes or a recovery email to get back into your account.

Set up a phone number or authenticator app first

Before you can turn on two-factor authentication, you need to tell Microsoft how you want to receive that second code. You have two main options: a text message to your phone, or an authenticator app.

A text message is the simplest. Microsoft sends a code to your phone number, you type it in, and you are in. An authenticator app like Microsoft Authenticator, Google Authenticator, or Authy generates a new code every 30 seconds on your phone without needing a text message. The app method is slightly more find because it does not rely on text message interception, but either one is far better than no second factor.

You can set up both a phone number and an app, which gives you a backup if one stops working. Most people start with a phone number because it requires nothing extra to install.

How to turn on two-step verification in your Microsoft account

Go to account.microsoft.com and sign in with your Outlook email and password. Click "Security" in the left menu, then look for "Two-step verification" or "Advanced security options" — the exact wording changes depending on your account type.

Click "Set up two-step verification" or "Turn on two-step verification". Microsoft will ask you to choose a phone number or authenticator app. If you choose a phone number, enter it and select whether you want codes by text or a phone call. Microsoft will send you a test code right away — enter it to confirm the number works.

If you choose an authenticator app, open the app on your phone, scan the QR code that appears on your screen, and enter the code the app generates. Once Microsoft confirms the code, the app is linked to your account.

After you confirm at least one method, click "Turn on" or "Enable" to set up two-step verification. From that moment forward, you will need a second code each time you sign in from a new device.

What happens the first time you sign in after turning it on

The next time you open Outlook on your computer or phone, or sign in through a web browser, you will see a new screen after you enter your password. It will ask you to verify your identity using the method you set up — either by entering a code from a text message or from your authenticator app.

On the same screen, you will usually see a checkbox that says "Don't ask me on this device for 30 days" or "Trust this device". If you check that box, Outlook will remember your device and will not ask for a code the next time you sign in from that same computer or browser. This is useful for your main work computer or personal phone, where you do not want to enter a code every single day. On a shared computer or a device you do not own, leave the box unchecked.

If you are signing in on a new device — like a work computer, a tablet, or a different browser on the same computer — you will need to enter the code again.

Use backup codes if you lose your phone

When you turn on two-step verification, Microsoft generates a list of one-time backup codes. These are long strings of numbers that work like a second factor if you cannot receive a text or access your authenticator app. Write them down or save them in a password manager, and keep them somewhere safe and separate from your phone.

If your phone is lost, stolen, or broken, you can use one of these codes to sign in. Each code works only once. After you use all of them, you will need to generate a new list in your account settings.

You can also add a recovery email address to your account. If you lose access to your phone, Microsoft can send a verification code to that email instead. Go to account.microsoft.com, click "Security", and look for "Recovery options" or "Additional security info".

Turn off two-step verification if you need to

If you decide two-step verification is too inconvenient, or if you are having trouble with it, you can turn it off. Go to account.microsoft.com, click "Security", find "Two-step verification", and click "Turn off" or "Disable". You will need to enter your password to confirm.

Turning it off means you will only need your password to sign in — no second code. Your account will be less find, but it will be faster to access. You can turn it back on anytime.

Troubleshooting common problems

You are not receiving text codes. Check that the phone number in your account is correct. Some carriers block text messages from Microsoft. Try switching to an authenticator app instead, or contact your phone carrier to ask if they filter automated messages. If you are outside the United States, text codes may not work — use an authenticator app.

Your authenticator app is not generating codes. Make sure your phone's clock is set to the correct time and time zone. Authenticator apps rely on your phone's clock to generate codes, and if it is off by more than a few minutes, the codes will not work. Restart the app and try again.

You are locked out and cannot access your phone or backup codes. Go to account.microsoft.com/security/two-step-verification/status and click "I can't use my authenticator app" or "I can't access my phone". Microsoft will ask you to verify your identity using your recovery email or a security question. This process can take a few minutes.

You want to use two-step verification on Outlook mobile but the app keeps asking for a code. On the Outlook mobile app for iPhone or Android, you can set up a PIN or biometric lock (fingerprint or face recognition) instead of entering a code every time. Go to Settings in the app, tap "Security", and turn on "Require PIN" or "Require biometric authentication". This gives you a second factor without needing to type a code on your phone.

Frequently Asked Questions

Do I have to use two-step verification if I use Outlook?

No. Two-step verification is optional. Microsoft recommends it, especially if your email is tied to sensitive accounts like banking or work, but you can use Outlook without it. However, if your account is ever compromised, two-step verification would have prevented the breach.

Will two-step verification work if I change my phone number?

If you change your phone number, you need to update it in your Microsoft account settings before your old number stops working. Go to account.microsoft.com, click "Security", and update your phone number under "Two-step verification". If you forget to update it and lose access to your old number, use your backup codes or recovery email to sign in and fix it.

Can I use the same authenticator app for multiple accounts?

Yes. Apps like Microsoft Authenticator, Google Authenticator, and Authy can hold codes for dozens of accounts. Each account gets its own entry in the app, and each generates its own code. This is actually a good setup — one app can protect your Outlook, your bank, your work account, and other services.

What if I get a new phone?

If you have an authenticator app on your old phone, you need to set it up on your new phone before you get rid of the old one. Open your account settings, remove the old app from your two-step verification settings, and add the new phone's app using the QR code. If you cannot access your old phone, use a backup code or your recovery email to sign in and update your settings.

Does two-step verification slow down my email?

No. Two-step verification only appears when you sign in — it does not affect how fast your email loads or how quickly you can read and send messages. Once you are signed in and have chosen to trust the device, you will not see it again for 30 days.