Summary

Two-step verification (also called two-factor authentication or MFA) adds an extra layer of security by requiring both your password and a second verification method — such as a phone app code, text message, or biometric — when signing in. This article shows how to enable it on your personal Microsoft, Google, and Apple accounts.

Before You Start

• A smartphone with an authenticator app installed (recommended: Microsoft Authenticator or Google Authenticator).
• Access to your personal account settings.
• No admin rights required.

Instructions

1. Enable Two-Step Verification on a Microsoft Account

Secure your personal Outlook.com, Xbox, or OneDrive account.

1. Open a browser and go to account.microsoft.com/security.
2. Sign in with your Microsoft account.
3. Select Advanced security options (or Security dashboard).
4. Under Two-step verification, click Turn on.
5. Follow the setup wizard:
   • Choose your verification method: Authenticator app (recommended), Phone number, or Email.
   • If using an authenticator app, scan the QR code with the app.
6. Save the recovery code provided — store it in a safe place.
7. Click Finish to complete the setup.

2. Enable Two-Step Verification on a Google Account

Secure your personal Gmail, YouTube, or Google Drive account.

1. Go to myaccount.google.com/security.
2. Sign in with your Google account.
3. Under Signing in to Google, click 2-Step Verification.
4. Click Get started.
5. Choose your verification method:
   • Google Prompts — Approve sign-in from your phone (easiest).
   • Authenticator app — Scan a QR code with your authenticator app.
   • Text message or phone call — Receive a code via SMS or voice call.
6. Follow the on-screen instructions to complete setup.
7. Save the backup codes provided and store them securely.

3. Enable Two-Factor Authentication on an Apple ID

Secure your personal iCloud, App Store, and Apple account.

1. On an iPhone or iPad, go to Settings > [your name] > Sign-In & Security.
2. Tap Two-Factor Authentication > Turn On (if not already enabled).
3. Enter your phone number to receive verification codes.
4. Choose to receive codes by Text Message or Phone Call.
5. Enter the verification code sent to your phone.
6. Two-factor authentication is now active for your Apple ID.

4. Best Practices for Two-Step Verification

Maximise the security benefit.

1. Use an authenticator app instead of SMS when possible — app-based codes are more secure than text messages.
2. Save your recovery/backup codes in a secure location (not on the same device). A password manager is the right home for them — it is encrypted, and you can still reach it from another device if your phone is the thing you have lost.
3. Do not share verification codes with anyone — legitimate services will never ask for them.
4. Enable two-step verification on all accounts that support it, not only email. Where a site offers a passkey instead, take that — it replaces the password and the code together, so there is no code to intercept and no password to reuse. How to Set Up and Use Passkeys on Your Phone and Browser shows how to save one with Face ID, a fingerprint, or your screen lock PIN, and how to use it on a computer when the passkey lives on your phone.

Troubleshooting

DANGER

If you lose access to your verification method (e.g., lost phone), use the recovery or backup codes you saved during setup. If you did not save recovery codes, contact the service's account recovery support.

Symptom / Error	Potential Cause	Solution
Cannot receive verification codes	Phone number changed or authenticator app removed	Use your saved backup codes to sign in, then update your verification method in account settings. If the app was on a phone you no longer have, see how to recover Microsoft Authenticator after losing your phone.
Two-step verification option is not available	Account settings restriction	Some school or managed accounts have this controlled centrally. Ask IT whether two-step verification is already enforced on your account, and how to enrol if it is.
Locked out of account after enabling MFA	Lost access to verification method	Use account recovery at the provider's recovery page (e.g., account.live.com/acsr for Microsoft).

Related Articles

• How to Use Microsoft Authenticator
• How to Transfer MFA to a New Phone
• How to Set Up and Use Passkeys on Your Phone and Browser
• How to Change Your M365 Password
• Understanding Microsoft 365 Account Security — What Protects You and Why

Did this solve your problem?